Security-59306.61.1.tar.gz

[apple/security.git] / OSX / lib / framework.sb

diff --git a/OSX/lib/framework.sb b/OSX/lib/framework.sb
index 74907d8dd2d085daff8dbd04d733a31884b81714..e37bf7c47def841913609503094eb5d8198ec524 100644 (file)
--- a/OSX/lib/framework.sb
+++ b/OSX/lib/framework.sb
@@ -1,4 +1,11 @@
 ;; allow clients to communicate with secd
 (allow mach-lookup (global-name "com.apple.secd"))
 ;; allow clients to communicate with coreauthd
-(allow mach-lookup (global-name "com.apple.CoreAuthentication.daemon.libxpc"))
+(allow mach-lookup (global-name "com.apple.CoreAuthentication.daemon"))
+(allow mach-lookup (global-name "com.apple.CoreAuthentication.agent"))
+;; allow clients to communicate with ctkd
+(allow mach-lookup (global-name "com.apple.ctkd.token-client"))
+
+;; On internal builds, allow clients to read the AMFITrustedKeys NVRAM variable
+(with-filter (system-attribute apple-internal)
+    (allow nvram-get (nvram-variable "AMFITrustedKeys")))