Rename Source/WebKit2 to Source/WebKit.
[WebKit-https.git] / Source / WebKit / Resources / SandboxProfiles / ios / com.apple.WebKit.WebContent.sb
1 ; Copyright (C) 2010-2015 Apple Inc. All rights reserved.
2 ;
3 ; Redistribution and use in source and binary forms, with or without
4 ; modification, are permitted provided that the following conditions
5 ; are met:
6 ; 1. Redistributions of source code must retain the above copyright
7 ; notice, this list of conditions and the following disclaimer.
8 ; 2. Redistributions in binary form must reproduce the above copyright
9 ; notice, this list of conditions and the following disclaimer in the
10 ; documentation and/or other materials provided with the distribution.
11 ;
12 ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
13 ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
14 ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
15 ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
16 ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
17 ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
18 ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
19 ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
20 ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
21 ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
22 ; THE POSSIBILITY OF SUCH DAMAGE.
23
24 (version 1)
25 (deny default (with partial-symbolication))
26 (allow system-audit file-read-metadata)
27
28 (deny mach-lookup (xpc-service-name-prefix ""))
29
30 (import "UIKit-apps.sb")
31
32 (uikit-app 'with-opengl 'with-location-services)
33
34 ;; Access to media controls
35 (play-media)
36 (media-remote)
37
38 (deny sysctl*)
39 (allow sysctl-read
40     (sysctl-name
41         "hw.availcpu"
42         "hw.ncpu"
43         "hw.model"
44         "kern.memorystatus_level"
45         "vm.footprint_suspend"))
46
47 ;; Read-only preferences and data
48 (mobile-preferences-read
49     "com.apple.LaunchServices"
50     "com.apple.WebFoundation"
51     "com.apple.mobileipod"
52     "com.apple.avfoundation.videoperformancehud" ;; <rdar://problem/31594568>
53     "com.apple.voiceservices.logging")
54
55 ;; Sandbox extensions
56 (define (apply-read-and-issue-extension op path-filter)
57     (op file-read* path-filter)
58     (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
59 (define (apply-write-and-issue-extension op path-filter)
60     (op file-write* path-filter)
61     (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
62 (define (read-only-and-issue-extensions path-filter)
63     (apply-read-and-issue-extension allow path-filter))
64 (define (read-write-and-issue-extensions path-filter)
65     (apply-read-and-issue-extension allow path-filter)
66     (apply-write-and-issue-extension allow path-filter))
67 (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read"))
68 (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write"))
69
70 ;; Access to client's cache folder & re-vending to CFNetwork.
71 ;; FIXME: Remove the webkti specific extension classes <rdar://problem/17755931>
72 (allow file-issue-extension (require-all
73     (extension "com.apple.app-sandbox.read-write")
74     (extension-class "com.apple.nsurlstorage.extension-cache")))
75
76 ;; MediaAccessibility
77 (mobile-preferences-read "com.apple.mediaaccessibility")
78 (mobile-preferences-read-write "com.apple.mediaaccessibility.public")
79
80 ;; Remote Web Inspector
81 (allow mach-lookup
82        (global-name "com.apple.webinspector"))
83
84 ;; Various services required by CFNetwork and other frameworks
85 (allow mach-lookup
86     (global-name "com.apple.PowerManagement.control")
87     (global-name "com.apple.accountsd.accountmanager")
88     (global-name "com.apple.analyticsd")
89     (global-name "com.apple.coremedia.audiodeviceclock"))
90
91 (deny file-write-create (vnode-type SYMLINK))
92 (deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\."))
93
94 ;; Allow loading injected bundles.
95 (allow file-map-executable)
96
97 ;; AWD logging
98 (awd-log-directory "com.apple.WebKit.WebContent")
99
100 (network-client (remote tcp) (remote udp))
101
102 ;; Allow ManagedPreference access
103 (allow file-read* (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist"))
104
105 ;; Allow mediaserverd to issue file extensions for the purposes of reading media
106 (allow file-issue-extension (require-all
107     (extension "com.apple.app-sandbox.read")
108     (extension-class "com.apple.mediaserverd.read")))
109
110 ;; Allow CoreMedia to communicate with mediaserverd in order to implement custom media loading
111 (allow mach-lookup
112     (global-name "com.apple.coremedia.customurlloader.xpc"))
113
114 (allow iokit-open
115     (iokit-user-client-class "IOHIDEventServiceFastPathUserClient")) ; <rdar://problem/28893177>
116
117 ;; Media capture, microphone access
118 (with-filter (extension "com.apple.webkit.microphone")
119     (allow device-microphone))
120
121 ;; Media capture, camera access
122 (with-filter (extension "com.apple.webkit.camera")
123     (allow user-preference-read
124         (preference-domain "com.apple.coremedia"))
125     (allow file-read* (subpath "/Library/CoreMediaIO/Plug-Ins/DAL"))
126     (allow mach-lookup (extension "com.apple.app-sandbox.mach"))
127     (allow device-camera))
128
129 ;; Support incoming video connections
130 (allow mach-lookup
131     (global-name "com.apple.audio.audiohald")
132     (global-name "com.apple.coremedia.compressionsession")
133     (global-name "com.apple.coremedia.decompressionsession")
134     (global-name "com.apple.coremedia.videoqueue"))