(version 1)

(deny default)

(allow ipc-posix-shm sysctl-read system-audit system-socket file-read-metadata)

(allow file-read*

       ;; Basic system paths

       (subpath "/System")

       (subpath "/usr/share")

       (subpath "/Library/Fonts")

       (literal "/dev/dtracehelper")

       (literal "/dev/urandom")

       (literal "/private/var/db/mds/messages/se_SecurityMessages")

       ;; System and user preferences

       (literal "/Library/Preferences/.GlobalPreferences.plist")

       (literal (string-append (param "_HOME") "/Library/Preferences/.GlobalPreferences.plist"))

       (regex (string-append "^" (param "_HOME") "/Library/Preferences/ByHost/\.GlobalPreferences\."))

       (literal (string-append (param "_HOME") "/Library/Preferences/com.apple.LaunchServices.plist"))

       ;; On-disk WebKit2 framework location, to account for debug installations

       ;; outside of /System/Library/Frameworks

       (subpath (param "webkit2_framework_path"))

       ;; Extensions from UIProcess

       (extension))

(allow file*

       ;; Our caches are writable

       (subpath (string-append (param "_HOME") "/Library/Caches/com.apple.WebProcess"))

       (literal "/dev/dtracehelper"))

(allow iokit-open

       ;; This will need to be rethought once we're using accelerated graphics,

       ;; since we probably can't pre-enumerate the client classes for graphics cards

       (iokit-user-client-class "IOHIDParamUserClient")

       (iokit-user-client-class "RootDomainUserClient"))

(allow mach-lookup

       ;; Various services required by AppKit and other frameworks

       (global-name "com.apple.CoreServices.coreservicesd")

       (global-name "com.apple.FontObjectsServer")

       (global-name "com.apple.FontServer")

       (global-name "com.apple.SystemConfiguration.configd")

       (global-name "com.apple.cookied")

       (global-name "com.apple.distributed_notifications.2")

       (global-name "com.apple.dock.server")

       (global-name "com.apple.system.logger")

       (global-name "com.apple.system.notification_center")

       (global-name "com.apple.window_proxies")

       (global-name "com.apple.windowserver.active")

       (global-name "com.apple.SecurityServer")

       (global-name "com.apple.ocspd")

       (local-name "com.apple.WebKit.WebProcess"))

(allow network-outbound

       ;; Local mDNSResponder for DNS, arbitrary outbound TCP

       (literal "/private/var/run/mDNSResponder")

       (remote tcp))