1 ; -*- Mode: Scheme; tab-width: 4 -*-
3 ; Copyright (c) 2007 Apple Inc. All rights reserved.
5 ; Redistribution and use in source and binary forms, with or without
6 ; modification, are permitted provided that the following conditions are met:
8 ; 1. Redistributions of source code must retain the above copyright notice,
9 ; this list of conditions and the following disclaimer.
10 ; 2. Redistributions in binary form must reproduce the above copyright notice,
11 ; this list of conditions and the following disclaimer in the documentation
12 ; and/or other materials provided with the distribution.
13 ; 3. Neither the name of Apple Computer, Inc. ("Apple") nor the names of its
14 ; contributors may be used to endorse or promote products derived from this
15 ; software without specific prior written permission.
17 ; THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18 ; EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 ; WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20 ; DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21 ; DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 ; (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 ; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24 ; ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 ; (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
26 ; SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 ; $Log: mDNSResponder.sb,v $
29 ; Revision 1.25 2008/03/17 18:04:41 mcguire
30 ; <rdar://problem/5800476> SC now reads preference file
32 ; Revision 1.24 2007/09/20 22:33:17 cheshire
33 ; Tidied up inconsistent and error-prone naming -- used to be mDNSResponderHelper in
34 ; some places and mDNSResponder.helper in others; now mDNSResponderHelper everywhere
36 ; Revision 1.23 2007/09/04 22:26:18 mcguire
37 ; <rdar://problem/5442826> Seatbelt: mDNSResponder needs to be allowed to access "/Library/Security/Trust Settings/" etc.
39 ; Revision 1.22 2007/08/24 22:01:56 mcguire
40 ; <rdar://problem/5141606> BTMM: Task: Change mDNSResponder Seatbelt settings to "deny default" instead of "signal FPE" just prior to GM candidate
42 ; Revision 1.21 2007/08/18 01:02:03 mcguire
43 ; <rdar://problem/5415593> No Bonjour services are getting registered at boot
45 ; Revision 1.20 2007/08/08 22:34:59 mcguire
46 ; <rdar://problem/5197869> Security: Run mDNSResponder as user id mdnsresponder instead of root
48 ; Revision 1.19 2007/07/02 23:37:50 cheshire
49 ; <rdar://problem/5267615> Need to list of allowed mach-lookup operations explicitly in mDNSResponder.sb
51 ; Revision 1.18 2007/06/28 20:43:35 cheshire
52 ; <rdar://problem/5298202> Seatbelt: mDNSResponder needs to be able to access /dev/autofs_nowait
54 ; Revision 1.17 2007/06/28 20:34:45 cheshire
55 ; Updated comments to reflect new seatbelt language syntax
57 ; Revision 1.16 2007/05/29 23:32:46 cheshire
58 ; Rearrange file so SPI warning isn't deleted when CVS history is trimmed from installed copy
60 ; Revision 1.15 2007/05/25 22:45:17 jvidrine
61 ; <rdar://problem/5227658> Update mDNSResponder.sb to Seatbelt Profile Language version 1
63 ; Revision 1.14 2007/05/23 17:40:08 cheshire
64 ; <rdar://problem/5221397> Seatbelt killed mDNSResponder trying to read X509Anchors and X509Certificates
66 ; Revision 1.13 2007/05/23 01:47:59 cheshire
67 ; Need to list fs_read_data permission explicitly --
68 ; unlike fs_read/fs_write, fs_read_data does NOT automatically inherit from fs_write_data
70 ; Revision 1.12 2007/05/21 23:52:27 cheshire
71 ; <rdar://problem/5216638> Seatbelt killed mDNSResponder generating Module Directory Services cache
73 ; Revision 1.11 2007/05/20 16:29:06 cheshire
74 ; <rdar://problem/5213725> Seatbelt killed mDNSResponder trying to access /usr/share/icu/icudt36l.dat
76 ; Revision 1.10 2007/05/15 00:21:39 cheshire
77 ; <rdar://problem/5202374> Seatbelt killed mDNSResponder reading /private/var/root/Library/Preferences/com.apple.security.plist
79 ; Revision 1.9 2007/05/14 22:08:26 cheshire
80 ; <rdar://problem/5200986> Seatbelt: Need to escape literal dots in filename patterns
82 ; Revision 1.8 2007/05/14 19:39:31 cheshire
83 ; <rdar://problem/5198345> Seatbelt killed mDNSResponder in CFTimeZoneCopyDefault
84 ; <rdar://problem/5199456> Seatbelt killed mDNSResponder in SecKeychainOpen
86 ; Revision 1.7 2007/05/12 01:57:56 cheshire
87 ; <rdar://problem/5197938> Seatbelt: mDNSResponder needs to be able to access preferences.plist-lock
89 ; Revision 1.6 2007/05/10 21:12:14 cheshire
90 ; <rdar://problem/5149833> Start using "debug deny" mode in Seatbelt
92 ; Revision 1.5 2007/05/10 19:41:25 cheshire
93 ; <rdar://problem/5182549> Have to use "deny mach_lookup_default" because "signal" doesn't work
95 ; Revision 1.4 2007/04/27 20:46:31 cheshire
96 ; Additional requirements: allow mDNSResponder to read /dev/random and /System/Library/Keychains/System.*
98 ; Revision 1.3 2007/04/20 19:42:14 cheshire
99 ; Condense rules a bit to bring file under Seatbelt's 4K limit
101 ; Revision 1.2 2007/04/19 01:47:49 cheshire
102 ; Refinements to sandbox profile, e.g. allow writing to /dev/console early in the boot process
104 ; Revision 1.1 2007/04/18 00:50:47 cheshire
105 ; <rdar://problem/5141540> Sandbox mDNSResponder
107 ;############################################################################
109 ; WARNING! SEATBELT CURRENTLY CAN'T HANDLE PROFILES LARGER THAN 16K
110 ; MAKE SURE THE SIZE OF THIS FILE FROM "version" TO THE END DOESN'T EXCEED 16K
114 ; WARNING: The sandbox rule capabilities and syntax used in this file are currently an
115 ; Apple SPI (System Private Interface) and are subject to change at any time without notice.
116 ; Apple may in future announce an official public supported sandbox API, but until then Developers
117 ; are cautioned not to build products that use or depend on the sandbox facilities illustrated here.
119 ; Use "debug all" to log all operations examined by seatbelt, whether allowed or not.
120 ; Use "debug deny" to log only operations that are denied by seatbelt
121 ; to discover what specific attempted operation is causing an exception.
126 ; To help debugging, "with send-signal SIGFPE" will trigger a fake floating-point exception,
127 ; which will crash the process and show the call stack leading to the offending operation.
128 ; For the shipping version "deny" is probably better because it vetoes the operation
129 ; without killing the process.
132 ;(deny default (with send-signal SIGFPE))
134 ; Special exception: "send-signal" command does not apply to the mach-* operations,
135 ; so for those we have to use a plain unadorned "deny" instead
136 ; (which means we may not get any notification of unintentional mach-* denials)
138 (deny mach-priv-host-port)
140 ; Mach communications
141 ; These are needed for things like getpwnam, hostname changes, & keychain
142 (allow mach-lookup (global-name
143 "com.apple.bsd.dirhelper"
144 "com.apple.distributed_notifications.2"
146 "com.apple.mDNSResponderHelper"
147 "com.apple.SecurityServer"
148 "com.apple.SystemConfiguration.configd"
149 "com.apple.system.DirectoryService.libinfo_v1"
150 "com.apple.system.notification_center"))
152 ; Rules to allow the operations mDNSResponder needs start here
154 (allow network*) ; Allow networking, including Unix Domain Sockets
155 (allow sysctl-read) ; To get hardware model information
156 (allow file-read-metadata) ; Needed for dyld to work
157 (allow ipc-posix-shm) ; Needed for POSIX shared memory
159 (allow file-read-data (regex "^/dev/random\$"))
160 (allow file-read-data file-write-data (regex "^/dev/console\$")) ; Needed for syslog early in the boot process
161 (allow file-read-data (regex "^/dev/autofs_nowait\$")) ; Used by CF to circumvent automount triggers
163 ; Allow us to read and write our socket
164 (allow file-read* file-write* (regex "^/private/var/run/mDNSResponder\$"))
166 ; Allow us to read system version, settings, and other miscellaneous necessary file system accesses
167 (allow file-read-data (regex "^/usr/sbin(/mDNSResponder)?\$")) ; Needed for CFCopyVersionDictionary()
168 (allow file-read-data (regex "^/usr/share/icu/.*\$"))
169 (allow file-read-data (regex "^/usr/share/zoneinfo/.*\$"))
170 (allow file-read-data (regex "^/System/Library/CoreServices/SystemVersion.*\$"))
171 (allow file-read-data (regex "^/Library/Preferences/SystemConfiguration/preferences\.plist\$"))
172 (allow file-read-data (regex "^/Library/Preferences/(ByHost/)?\.GlobalPreferences.*\.plist\$"))
173 (allow file-read-data (regex "^/Library/Preferences/com\.apple\.security.*\.plist\$"))
174 (allow file-read-data (regex "^/Library/Preferences/com\.apple\.crypto\.plist\$"))
175 (allow file-read-data (regex "^/Library/Security/Trust Settings/Admin\.plist\$"))
176 (allow file-read-data (regex "^/System/Library/Preferences/com\.apple\.security.*\.plist\$"))
177 (allow file-read-data (regex "^/System/Library/Preferences/com\.apple\.crypto\.plist\$"))
179 ; Allow access to System Keychain
180 (allow file-read-data (regex "^/System/Library/Security\$"))
181 (allow file-read-data (regex "^/System/Library/Keychains/.*\$"))
182 (allow file-read-data (regex "^/Library/Keychains/System\.keychain\$"))
183 ; Our Module Directory Services cache
184 (allow file-read-data (regex "^/private/var/tmp/mds/"))
185 (allow file-read* file-write* (regex "^/private/var/tmp/mds/[0-9]+(/|\$)"))