mDNSMacOSX/mDNSResponder.sb

   1 ; -*- Mode: Scheme; tab-width: 4 -*-
   2 ;
   3 ; Copyright (c) 2007 Apple Inc. All rights reserved.
   4 ;
   5 ; Redistribution and use in source and binary forms, with or without
   6 ; modification, are permitted provided that the following conditions are met:
   7 ;
   8 ; 1.  Redistributions of source code must retain the above copyright notice,
   9 ;     this list of conditions and the following disclaimer.
  10 ; 2.  Redistributions in binary form must reproduce the above copyright notice,
  11 ;     this list of conditions and the following disclaimer in the documentation
  12 ;     and/or other materials provided with the distribution.
  13 ; 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of its
  14 ;     contributors may be used to endorse or promote products derived from this
  15 ;     software without specific prior written permission.
  16 ;
  17 ; THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  18 ; EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  19 ; WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
  20 ; DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  21 ; DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  22 ; (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
  23 ; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  24 ; ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  25 ; (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
  26 ; SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  27 ;
  28 ;############################################################################
  29
  30 (version 1)
  31
  32 ; WARNING: The sandbox rule capabilities and syntax used in this file are currently an
  33 ; Apple SPI (System Private Interface) and are subject to change at any time without notice.
  34 ; Apple may in future announce an official public supported sandbox API, but until then Developers
  35 ; are cautioned not to build products that use or depend on the sandbox facilities illustrated here.
  36
  37 ; Use "debug all" to log all operations examined by seatbelt, whether allowed or not.
  38 ; Use "debug deny" to log only operations that are denied by seatbelt
  39 ; to discover what specific attempted operation is causing an exception.
  40
  41 ;(debug all)
  42 (debug deny)
  43
  44 ; To help debugging, "with send-signal SIGFPE" will trigger a fake floating-point exception,
  45 ; which will crash the process and show the call stack leading to the offending operation.
  46 ; For the shipping version "deny" is probably better because it vetoes the operation
  47 ; without killing the process.
  48
  49 (deny default)
  50 ;(deny default (with send-signal SIGFPE))
  51
  52 ; Special exception: "send-signal" command does not apply to the mach-* operations,
  53 ; so for those we have to use a plain unadorned "deny" instead
  54 ; (which means we may not get any notification of unintentional mach-* denials)
  55 (deny mach-lookup)
  56 (deny mach-priv-host-port)
  57
  58 ; Mach communications
  59 ; These are needed for things like getpwnam, hostname changes, & keychain
  60 (allow mach-lookup (global-name
  61                                         "com.apple.bsd.dirhelper"
  62                                         "com.apple.distributed_notifications.2"
  63                                         "com.apple.ocspd"
  64                                         "com.apple.PowerManagement.control"
  65                                         "com.apple.mDNSResponderHelper"
  66                                         "com.apple.SecurityServer"
  67                                         "com.apple.SystemConfiguration.configd"
  68                                         "com.apple.SystemConfiguration.SCNetworkReachability"
  69                                         "com.apple.system.DirectoryService.libinfo_v1"
  70                                         "com.apple.system.DirectoryService.membership_v1"
  71                                         "com.apple.system.notification_center"
  72                                         "com.apple.system.logger"
  73                                         "com.apple.webcontentfilter.dns"
  74                                         "com.apple.server.bluetooth"
  75                                         "com.apple.awacs"
  76                                         "com.apple.blued"))
  77
  78 ; Rules to allow the operations mDNSResponder needs start here
  79
  80 (allow signal (target self))
  81 (allow network*)                        ; Allow networking, including Unix Domain Sockets
  82 (if (defined? 'system-socket)
  83     (allow system-socket))  ; To create raw sockets
  84 (allow sysctl-read)                     ; To get hardware model information
  85 (allow sysctl-write)            ; Needed for CFSocket
  86 (allow file-read-metadata)      ; Needed for dyld to work
  87 (allow ipc-posix-shm)           ; Needed for POSIX shared memory
  88
  89 (allow file-read-data                 (regex #"^/dev/random$"))
  90 (allow file-read-data file-write-data (regex #"^/dev/console$"))                ; Needed for syslog early in the boot process
  91 (allow file-read-data                 (regex #"^/dev/autofs_nowait$"))  ; Used by CF to circumvent automount triggers
  92 (allow file-read-data                 (regex #"^/private/etc/hosts$"))                  ; /etc/hosts support
  93 (allow file-read-data                 (regex #"^/private/etc$"))                                ; /etc/hosts support
  94
  95 ; Allow us to read and write our socket
  96 (allow file-read*     file-write*     (regex #"^/private/var/run/mDNSResponder$"))
  97
  98 ; Allow us to read system version, settings, and other miscellaneous necessary file system accesses
  99 (allow file-read-data                 (regex #"^/dev/urandom$"))
 100 (allow file-read-data                 (regex #"^/usr/sbin(/mDNSResponder)?$"))          ; Needed for CFCopyVersionDictionary()
 101 (allow file-read-data                 (regex #"^/usr/share/icu/.*$"))
 102 (allow file-read-data                 (regex #"^/usr/share/zoneinfo/.*$"))
 103 (allow file-read-data                 (regex #"^/Library/Preferences/SystemConfiguration/preferences\.plist$"))
 104 (allow file-read-data                 (regex #"^/Library/Preferences/SystemConfiguration/com\.apple\.nat\.plist$"))
 105 (allow file-read-data                 (regex #"^/Library/Preferences/(ByHost/)?\.GlobalPreferences.*\.plist$"))
 106 (allow file-read-data                 (regex #"^/Library/Preferences/com\.apple\.security.*\.plist$"))
 107 (allow file-read-data                 (regex #"^/Library/Preferences/com\.apple\.crypto\.plist$"))
 108 (allow file-read-data                 (regex #"^/Library/Security/Trust Settings/Admin\.plist$"))
 109 (allow file-read-data                 (regex #"^/System/Library/CoreServices/SystemVersion.*$"))
 110 (allow file-read-data                 (regex #"^/System/Library/Preferences/com\.apple\.security.*\.plist$"))
 111 (allow file-read-data                 (regex #"^/System/Library/Preferences/com\.apple\.crypto\.plist$"))
 112 (allow file-read-data                 (regex #"^/System/Library/SystemConfiguration/PowerManagement\.bundle(/|$)"))
 113 (allow file-read-data                 (regex #"^/Library/Preferences/SystemConfiguration/com\.apple\.PowerManagement\.plist$"))
 114 (allow file-read-data                 (regex #"^/private/var/preferences/SystemConfiguration/preferences\.plist$"))
 115
 116 ; Allow access to System Keychain
 117 (allow file-read-data                 (regex #"^/System/Library/Security$"))
 118 (allow file-read-data                 (regex #"^/System/Library/Keychains/.*$"))
 119 ; We just need access to System.keychain. But we don't want errors logged if other keychains are
 120 ; accessed under /Library/Keychains. Other keychains may be accessed as part of setting up an SSL
 121 ; connection. Instead of adding access to it here(to things which we don't need), we disable any
 122 ; logging that might happen during the access
 123 (deny  file-read-data                 (regex #"^/Library/Keychains/") (with no-log))
 124 (allow file-read-data                 (regex #"^/Library/Keychains/System\.keychain$"))
 125 ; Our Module Directory Services cache
 126 (allow file-read-data                 (regex #"^/private/var/tmp/mds/"))
 127 (allow file-read* file-write*         (regex #"^/private/var/tmp/mds/[0-9]+(/|$)"))
 128 (allow file-read-data                 (regex #"^/private/var/db/mds/"))
 129 (allow file-read* file-write*         (regex #"^/private/var/db/mds/[0-9]+(/|$)"))
 130 (allow file-read* file-write*         (regex #"^/private/var/folders/[^/]+/[^/]+/C/mds(/|$)"))
 131 (allow file-read* file-write*         (regex #"^/private/var/folders/[^/]+/[^/]+/-Caches-/mds(/|$)")) ; Required on 10.5 and 10.6
 132 ; CRL Cache for SSL/TLS connections
 133 (allow file-read-data                 (regex #"^/private/var/db/crls/crlcache\.db$"))
 134
 135 ; For mDNS sleep proxy offload and IOPMConnectionCreate
 136 (if (defined? 'iokit-open)
 137    (begin
 138      (allow iokit-open (iokit-user-client-class "NVEthernetUserClientMDNS"))
 139      (allow iokit-open (iokit-user-client-class "mDNSOffloadUserClient"))
 140      (allow iokit-open (iokit-user-client-class "RootDomainUserClient"))))
 141
 142 ; For D2D
 143 (allow file-read-data (regex #"^/System/Library/PrivateFrameworks/DeviceToDeviceManager.framework(/|$)"))
 144 (allow file-read-data (regex #"^/System/Library/PrivateFrameworks/MobileBluetooth.framework(/|$)"))
 145 (allow file-read-data (regex #"^/System/Library/Frameworks/CoreFoundation.framework(/|$)"))
 146 (allow file-read-data (regex #"^/System/Library/Frameworks/SystemConfiguration.framework(/|$)"))
 147 (allow file-read-data (regex #"^/System/Library/Frameworks/IOKit.framework(/|$)"))
 148 (allow file-read-data (regex #"^/System/Library/Frameworks/Security.framework(/|$)"))
 149 (allow file-read-data file-write-data file-ioctl (regex #"^/dev/dtracehelper$"))
 150
 151 ; For WebFilterDNS framework
 152 (allow file-read-data (regex #"^/System/Library/PrivateFrameworks/WebFilterDNS.framework(/|$)"))