blob: 9ce0a10abde00e6f21ac1d7045b3547addedf4ed [file] [log] [blame]
; Copyright 2017 The Chromium Authors. All rights reserved.
; Use of this source code is governed by a BSD-style license that can be
; found in the LICENSE file.
(version 1)
; Helper function to check if a param is set to true.
(define (param-true? str) (string=? (param str) "TRUE"))
; Helper function to determine if a parameter is defined or not.
(define (param-defined? str) (string? (param str)))
; Define constants for all of the parameter strings passed in.
(define browser-pid "BROWSER_PID")
(define bundle-id "BUNDLE_ID")
(define bundle-path "BUNDLE_PATH")
(define component-path "COMPONENT_PATH")
(define current-pid "CURRENT_PID")
(define disable-sandbox-denial-logging "DISABLE_SANDBOX_DENIAL_LOGGING")
(define enable-logging "ENABLE_LOGGING")
(define executable-path "EXECUTABLE_PATH")
(define homedir-as-literal "USER_HOMEDIR_AS_LITERAL")
(define log-file-path "LOG_FILE_PATH")
(define os-version (string->number (param "OS_VERSION")))
; Backwards compatibility for 10.9
(if (not (defined? 'path))
(define path literal))
(if (not (defined? 'iokit-registry-entry-class))
(define iokit-registry-entry-class iokit-user-client-class))
; --enable-sandbox-logging causes the sandbox to log failures to the syslog.
(if (param-true? disable-sandbox-denial-logging)
(deny default (with no-log))
(deny default))
(if (param-true? enable-logging) (debug deny))
; Allow sending signals to self -
(allow signal (target self))
; Consumes a subpath and appends it to the user's homedir path.
(define (user-homedir-path subpath)
(string-append (param homedir-as-literal) subpath))
; A function that specific profiles (i.e. renderer) can call to allow
; font rendering.
(define (allow-font-access)
(allow file-read-data
(subpath "/Library/Fonts")
(subpath "/System/Library/Fonts")
(subpath (user-homedir-path "/Library/Fonts")))
(allow mach-lookup
(global-name "")
(global-name ""))
(if (< os-version 1012)
(allow mach-lookup (global-name "")))
; To allow accessing downloaded and other hidden fonts in
; /System/Library/Asssets/com_apple_MobileAsset_Font*.
; (
(allow file-read* (extension ""))))
; Allow logging for all processes.
(allow file-write*
(path (param log-file-path))
(vnode-type REGULAR-FILE)))
; Allow component builds to work.
(if (param-defined? component-path)
(allow file-read* (subpath (param component-path))))
(allow process-exec (path (param executable-path)))
(allow file-read* (path (param executable-path)))
(allow mach-lookup (global-name (string-append (param bundle-id)
(param browser-pid))))
; Allow realpath() to work.
(allow file-read-metadata (subpath "/"))
; All processes can read the bundle contents.
(allow file-read* (subpath (param bundle-path)))
; Allow reads of system libraries and frameworks.
(allow file-read*
(subpath "/System/Library/Frameworks")
(subpath "/System/Library/Preferences/Logging")
(subpath "/System/Library/PrivateFrameworks")
(subpath "/usr/lib"))
; Reads from /etc.
; This is read by CFPrefs calling getpwuid in a loop. libinfo then fails to
; contact any of the opendirectoryd mach services, and falls back to
; the /etc/passwd file for the user info. The access is OK because
; no actual password hashes are in /etc/passwd anymore.
(allow file-read-data (path "/private/etc/passwd"))
; Access to /dev.
(allow file-ioctl file-read-data file-write-data
(path "/dev/dtracehelper")
(vnode-type CHARACTER-DEVICE)))
(allow file-read-data
(path "/dev/null")
(path "/dev/random")
(path "/dev/urandom"))
(if (>= os-version 1013)
(begin (allow file-read* (subpath "/private/var/db/timezone"))
(allow file-read-data (subpath "/usr/share/zoneinfo.default"))))
(if (< os-version 1013)
(allow file-read-data (subpath "/usr/share/zoneinfo")))
; Reads from /Library.
(allow file-read-data
(path "/Library/Preferences/.GlobalPreferences.plist"))
; Reads from /System.
(allow file-read-data
(path "/System/Library/CoreServices/checkfixlist")
(path "/System/Library/CoreServices/SystemVersion.plist"))
; Reads from /usr.
(allow file-read-data
(subpath "/usr/share/icu"))
; Access to the home directory.
(allow file-read-data
(path (user-homedir-path "/Library/Preferences/.GlobalPreferences.plist"))
(regex (user-homedir-path #"/Library/Preferences/ByHost/.GlobalPreferences.*")))
; Mach IPC needed by all Chromium Helper instances.
(allow mach-lookup
(global-name "")
(global-name "")
(global-name ""))
; sysctls permitted.
(if (= os-version 1009)
(allow sysctl-read)
; else
(allow sysctl-read
(sysctl-name "hw.activecpu")
(sysctl-name "hw.busfrequency_compat")
(sysctl-name "hw.byteorder")
(sysctl-name "hw.cachelinesize_compat")
(sysctl-name "hw.cpufrequency_compat")
(sysctl-name "hw.cputype")
(sysctl-name "hw.machine")
(sysctl-name "hw.ncpu")
(sysctl-name "hw.pagesize_compat")
(sysctl-name "hw.physicalcpu_max")
(sysctl-name "hw.tbfrequency_compat")
(sysctl-name "hw.vectorunit")
(sysctl-name "kern.hostname")
(sysctl-name "kern.maxfilesperproc")
(sysctl-name "kern.osrelease")
(sysctl-name "kern.ostype")
(sysctl-name "kern.osversion")
(sysctl-name (string-append "" (param current-pid)))
(sysctl-name "kern.usrstack64")
(sysctl-name "kern.version")
(sysctl-name "sysctl.proc_cputype")))