mDNSMacOSX/mDNSResponder.sb

   1 ;
   2 ; Copyright (c) 2012-2020 Apple Inc. All rights reserved.
   3 ;
   4 ; Redistribution and use in source and binary forms, with or without
   5 ; modification, are permitted provided that the following conditions are met:
   6 ;
   7 ; 1.  Redistributions of source code must retain the above copyright notice,
   8 ;     this list of conditions and the following disclaimer.
   9 ; 2.  Redistributions in binary form must reproduce the above copyright notice,
  10 ;     this list of conditions and the following disclaimer in the documentation
  11 ;     and/or other materials provided with the distribution.
  12 ; 3.  Neither the name of Apple Inc. ("Apple") nor the names of its
  13 ;     contributors may be used to endorse or promote products derived from this
  14 ;     software without specific prior written permission.
  15 ;
  16 ; THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  17 ; EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  18 ; WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  19 ; DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  20 ; DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  21 ; (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  22 ; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  23 ; ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  24 ; (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  25 ; SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  26 ;
  27 ;############################################################################
  28
  29
  30 ; WARNING: The sandbox rule capabilities and syntax used in this file are currently an
  31 ; Apple SPI (System Private Interface) and are subject to change at any time without notice.
  32
  33 (version 1)
  34 ; When mDNSResponder is denied access, we want to avoid symoblification of mDNSResponder
  35 ; to get the stack trace as that can get into deadlock. no-callout will prevent
  36 ; symbolification.
  37 (deny default (with no-callout))
  38
  39 (import "system.sb")
  40
  41 ; Baseline
  42 (allow file-read-metadata ipc-posix-shm)
  43
  44 ; Mach communications
  45 ; These are needed for things like getpwnam, hostname changes, & keychain
  46 (allow mach-lookup
  47        (global-name "com.apple.analyticsd")
  48        (global-name "com.apple.awdd")
  49        (global-name "com.apple.bsd.dirhelper")
  50        (global-name "com.apple.CoreServices.coreservicesd")
  51        (global-name "com.apple.coreservices.quarantine-resolver")
  52        (global-name "com.apple.distributed_notifications.2")
  53        (global-name "com.apple.distributed_notifications@1v3")
  54        (global-name "com.apple.lsd.mapdb")
  55        (global-name "com.apple.nesessionmanager.content-filter")
  56        (global-name "com.apple.ocspd")
  57        (global-name "com.apple.powerlog.plxpclogger.xpc")
  58        (global-name "com.apple.PowerManagement.control")
  59        (global-name "com.apple.mDNSResponderHelper")
  60        (global-name "com.apple.mDNSResponder_Helper")
  61        (global-name "com.apple.SecurityServer")
  62        (global-name "com.apple.SystemConfiguration.configd")
  63        (global-name "com.apple.SystemConfiguration.SCNetworkReachability")
  64        (global-name "com.apple.SystemConfiguration.DNSConfiguration")
  65        (global-name "com.apple.SystemConfiguration.NetworkInformation")
  66        (global-name "com.apple.system.notification_center")
  67        (global-name "com.apple.system.logger")
  68        (global-name "com.apple.trustd")
  69        (global-name "com.apple.usymptomsd")
  70        (global-name "com.apple.webcontentfilter.dns")
  71        (global-name "com.apple.server.bluetooth")
  72        (global-name "com.apple.server.bluetooth.le.att.xpc")
  73        (global-name "com.apple.server.bluetooth.general.xpc")
  74        (global-name "com.apple.awacs")
  75        (global-name "com.apple.securityd")
  76        (global-name "com.apple.wifi.manager")
  77        (global-name "com.apple.wifip2pd")
  78        (global-name "com.apple.bluetoothd")
  79        (global-name "com.apple.mobilegestalt.xpc")
  80        (global-name "com.apple.networkd_privileged")
  81        (global-name "com.apple.dnssd.service")
  82        (global-name "com.apple.nehelper"))
  83
  84 (allow mach-register
  85        (global-name "com.apple.d2d.ipc"))
  86
  87 ; Networking, including Unix Domain Sockets
  88 (allow network*)
  89
  90 ; Raw sockets
  91 (if (defined? 'system-socket)
  92     (allow system-socket))
  93
  94 ; Hardware model information
  95 (allow sysctl-read)
  96
  97 ; Syslog early in the boot process
  98 (allow file-read-data file-write-data (literal "/dev/console"))
  99
 100 (allow file-read-data
 101        ; /etc/hosts support
 102        (literal "/private/etc/hosts")
 103        (literal "/private/etc"))
 104
 105 ; Our socket
 106 (allow file-read* file-write* (literal "/private/var/run/mDNSResponder"))
 107
 108 ; BPF control for sleep proxy server
 109 (allow file-ioctl (prefix "/dev/bpf"))
 110
 111 ; Used by CoreCrypto AES routines.
 112 (allow file-read* file-write-data file-ioctl
 113            (literal "/dev/aes_0"))
 114
 115 ; System version, settings, and other miscellaneous necessary file system accesses
 116 (allow file-read-data
 117        ; Needed for CFCopyVersionDictionary()
 118        (literal "/usr/sbin")
 119        (literal "/usr/sbin/mDNSResponder")
 120
 121        (literal "/Library/Preferences/com.apple.mDNSResponder.plist")
 122        (literal "/Library/Preferences/SystemConfiguration/preferences.plist")
 123        (literal "/Library/Preferences/SystemConfiguration/com.apple.nat.plist")
 124        (regex #"^/Library/Preferences/(ByHost/)?\.GlobalPreferences\.")
 125        (literal "/Library/Preferences/com.apple.crypto.plist")
 126        (literal "/Library/Security/Trust Settings/Admin.plist")
 127        (regex #"^/Library/Preferences/com\.apple\.security\.")
 128        (literal "/Library/Preferences/SystemConfiguration/com.apple.PowerManagement.plist")
 129        (literal "/private/var/preferences/com.apple.networkd.plist")
 130        (literal "/private/var/preferences/SystemConfiguration/preferences.plist")
 131        (subpath "/System/Library/Preferences/Logging")
 132        (subpath "/AppleInternal/Library/Preferences/Logging")
 133        (subpath "/private/var/preferences/Logging")
 134        (subpath "/private/var/db/timezone")
 135        (subpath "/Library/Preferences/Logging"))
 136
 137
 138 ; For MAC Address
 139 (allow system-info (info-type "net.link.addr"))
 140
 141 ; We just need access to System.keychain. But we don't want errors logged if other keychains are
 142 ; accessed under /Library/Keychains. Other keychains may be accessed as part of setting up an SSL
 143 ; connection. Instead of adding access to it here (to things which we don't need), we disable any
 144 ; logging that might happen during the access
 145 (deny file-read-data (regex #"^/Library/Keychains/") (with no-log))
 146 (allow file-read-data (literal "/Library/Keychains/System.keychain"))
 147
 148
 149 ; Our Module Directory Services cache
 150 (allow file-read-data
 151        (subpath "/private/var/tmp/mds")
 152        (subpath "/private/var/db/mds"))
 153
 154 (allow file-read* file-write*
 155        (regex #"^/private/var/tmp/mds/[0-9]+(/|$)")
 156        (regex #"^/private/var/db/mds/[0-9]+(/|$)")
 157        (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds(/|$)")
 158
 159        ; Required on 10.5 and 10.6
 160        (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds(/|$)"))
 161
 162 ; CRL Cache for SSL/TLS connections
 163 (allow file-read-data (literal "/private/var/db/crls/crlcache.db"))
 164
 165 ; For mDNS sleep proxy offload and IOPMConnectionCreate
 166 (if (defined? 'iokit-open)
 167    (begin
 168      (allow iokit-open
 169         (iokit-user-client-class "NVEthernetUserClientMDNS")
 170         (iokit-user-client-class "mDNSOffloadUserClient")
 171         (iokit-user-client-class "wlDNSOffloadUserClient")
 172         (iokit-user-client-class "RootDomainUserClient")
 173         (iokit-user-client-class "AppleMobileFileIntegrityUserClient"))))
 174
 175 ; Internal builds only
 176 (with-filter (system-attribute apple-internal)
 177     (allow sysctl-read sysctl-write
 178         (sysctl-name "vm.footprint_suspend"))) ; dyld performance reporting
 179
 180 ; Used to dump internal state
 181 ; Allows directory lookup, and creating, reading and writing files under /private/var/log/mDNSResponder
 182 ; We know that this sandbox rule seems to give the broader access to mDNSResponder, but given the fact that the directory
 183 ; "/private/var/log/mDNSResponder" is owned by user "_mdnsresponder" who is in "wheel" group, no one else would have the
 184 ; access to this directory, so there is not much security concern.
 185 (allow file-read* file-write* (subpath "/private/var/log/mDNSResponder"))
 186
 187 ; <rdar://problem/65700296> mDNSResponder sandbox profile needs to allow loading dylibs from /usr/appleinternal/lib/sanitizers
 188 (with-filter (system-attribute apple-internal)
 189     (allow file-read* file-map-executable
 190                (subpath "/usr/appleinternal/lib/sanitizers/")))