;; MacOSX Sandbox profile for bundled firefox
;;
;; Copyright 2010 Robert Malmgren AB. All rights reserved.
;;
;; Redistribution and use in source and binary forms, with or without modification, are
;; permitted provided that the following conditions are met:
;;
;;   1. Redistributions of source code must retain the above copyright notice, this list of
;;      conditions and the following disclaimer.
;;
;;   2. Redistributions in binary form must reproduce the above copyright notice, this list
;;      of conditions and the following disclaimer in the documentation and/or other materials
;;      provided with the distribution.
;;
;; THIS SOFTWARE IS PROVIDED BY Robert Malmgren AB ``AS IS'' AND ANY EXPRESS OR IMPLIED
;; WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
;; FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL <COPYRIGHT HOLDER> OR
;; CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
;; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
;; SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
;; ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
;; NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
;; ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
;; 
;; The views and conclusions contained in the software and documentation are those of the
;; authors and should not be interpreted as representing official policies, either expressed
;; or implied, of Robert Malmgren AB.
;;
;; Written by andreas@romab.com 
(version 1)

(deny default)
; help with debug.
(debug deny)

(allow network-outbound)
(allow file-read-data file-read-metadata
       (literal "/Library/Preferences/com.apple.HIToolbox.plist")
       (literal "/Library/Preferences/.GlobalPreferences.plist")
       (regex "^FIREFOXDIR/Contents/.*")
       (literal "FIREFOXDIR/Contents")
       (regex "^LIBRARYDIR/Application Support/Firefox/Profiles/profile/.*")
       (literal "LIBRARYDIR/Application Support/Firefox/Profiles/profile")
       (regex "^/System/.*")
;       (regex "^TMPDIR/.*") ;; macosx shellenv. 
       (regex "^/usr/lib/.*")
       (literal "/private/etc/passwd")
       (regex "^/Library/Fonts/.*")
       (literal "/dev/null")
       (regex "^/usr/share/.*")
       (literal "/dev/urandom"))
	

(allow file-read-data 
       (literal "FIREFOXDIR")
       (literal "/dev/dtracehelper"))

(allow file-read-metadata
       (literal "/")
       (literal "FIREFOXDIR")
       (literal "LIBRARYDIR/Application Support/Firefox/Profiles")
       (literal "LIBRARYDIR/Application Support/Firefox")
       (literal "LIBRARYDIR/Application Support")
       (literal "LIBRARYDIR")
       (literal "/etc")
       (literal "/var")
       (literal "/tmp")
       (literal "/private/tmp")
       (literal "/private/var/tmp")
       (literal "/private/etc/localtime"))

(allow file-write* (regex "^LIBRARYDIR/Application Support/Firefox/Profiles/profile/.*"))
	
(allow file-write-data
;       (regex "^TMPDIR/.*") ;; macosx shellenv, we will fix this later
       (literal "/dev/dtracehelper"))

(allow ipc-posix-shm)

(allow mach-lookup
       (global-name "com.apple.CoreServices.coreservicesd")
       (global-name "com.apple.SecurityServer")
       (global-name "com.apple.SystemConfiguration.configd")
       (global-name "com.apple.distributed_notifications.2")
       (global-name "com.apple.dock.server")
       (global-name "com.apple.system.DirectoryService.libinfo_v1")
       (global-name "com.apple.system.DirectoryService.membership_v1")
       (global-name "com.apple.system.logger")
       (global-name "com.apple.system.notification_center")
       (global-name "com.apple.FontObjectsServer")
       (global-name "com.apple.FontServer")
       (global-name "com.apple.pasteboard.1")
       (global-name "com.apple.windowserver.active")
       (global-name "com.apple.tsm.uiserver")
       (global-name "com.apple.DiskArbitration.diskarbitrationd")
       (global-name "com.apple.windowserver.session"))

(allow process-exec
	;; netstat needed for entropy. part of lib_nss.
       (literal "/usr/sbin/netstat")
       (literal "FIREFOXDIR/Contents/MacOS/firefox-bin2"))
(allow process-fork)

(allow sysctl-read)
