[iOS] Deny mach lookup access to content filter service in the WebContent sandbox
[WebKit.git] / Source / WebKit / Resources / SandboxProfiles / ios / com.apple.WebKit.WebContent.sb
1 ; Copyright (C) 2010-2019 Apple Inc. All rights reserved.
2 ;
3 ; Redistribution and use in source and binary forms, with or without
4 ; modification, are permitted provided that the following conditions
5 ; are met:
6 ; 1. Redistributions of source code must retain the above copyright
7 ; notice, this list of conditions and the following disclaimer.
8 ; 2. Redistributions in binary form must reproduce the above copyright
9 ; notice, this list of conditions and the following disclaimer in the
10 ; documentation and/or other materials provided with the distribution.
11 ;
12 ; THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
13 ; AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
14 ; THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
15 ; PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
16 ; BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
17 ; CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
18 ; SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
19 ; INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
20 ; CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
21 ; ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
22 ; THE POSSIBILITY OF SUCH DAMAGE.
23
24 (version 1)
25 (deny default (with partial-symbolication))
26 (allow system-audit file-read-metadata)
27
28 ;;;
29 ;;; The following rules were originally contained in 'common.sb'. We are duplicating them here so we can
30 ;;; remove unneeded sandbox extensions.
31 ;;;
32
33 (import "util.sb")
34 (import "carrier-bundle-allowed.sb")
35
36 (define-once (allow-read-and-issue-generic-extensions . filters)
37     (allow file-read*
38            (apply require-any filters))
39     (allow file-issue-extension
40         (require-all
41             (extension-class "com.apple.app-sandbox.read")
42             (apply require-any filters))))
43
44 (define-once (allow-read-write-and-issue-generic-extensions . filters)
45     (allow file-read* file-write*
46            (apply require-any filters))
47     (allow file-read-metadata
48            (apply require-any filters))
49     (allow file-issue-extension
50         (require-all
51             (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read")
52             (apply require-any filters))))
53
54 (define-once (managed-configuration-read-public)
55     (allow file-read*
56            (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/PublicInfo")
57            (front-user-home-subpath "/Library/ConfigurationProfiles/PublicInfo")
58            (front-user-home-subpath "/Library/UserConfigurationProfiles/PublicInfo")))
59
60 (define-once (managed-configuration-read . files)
61     (if (null? files)
62         (allow file-read*
63                (well-known-system-group-container-subpath "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles")
64                (front-user-home-subpath "/Library/ConfigurationProfiles")
65                (front-user-home-subpath "/Library/UserConfigurationProfiles"))
66         (for-each
67             (lambda (file)
68                 (allow file-read*
69                     (well-known-system-group-container-literal
70                         (string-append "/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/" file))
71                     (front-user-home-literal
72                         (string-append "/Library/ConfigurationProfiles/" file)
73                         (string-append "/Library/UserConfigurationProfiles/" file))))
74             files)))
75
76 (define-once (allow-preferences-common)
77     (allow file-read-metadata
78            (home-literal "")
79            (home-literal "/Library/Preferences")))
80
81 (define-once (mobile-preferences-read . domains)
82     (allow-preferences-common)
83     (allow user-preference-read (apply preference-domain domains)))
84
85 (define-once (mobile-preferences-read-write . domains)
86     (allow-preferences-common)
87     (allow user-preference-read user-preference-write (apply preference-domain domains)))
88
89 (define-once (framebuffer-access)
90     (allow iokit-open
91            (iokit-user-client-class "IOMobileFramebufferUserClient"))
92     (mobile-preferences-read "com.apple.iokit.IOMobileGraphicsFamily"))
93
94 (define-once (asset-access . options)
95     (let ((asset-access-filter
96             (require-all
97               (require-any
98                 (home-subpath "/Library/Assets")
99                 (subpath "/private/var/MobileAsset"))
100               (extension "com.apple.assets.read"))))
101         ;; <rdar://problem/10710883>
102         ;; <rdar://problem/11569106>
103         (allow file-read* asset-access-filter)
104         (if (memq 'with-media-playback options)
105             (play-media asset-access-filter))
106         (allow mach-lookup (with report) (with telemetry)
107                (global-name "com.apple.mobileassetd" "com.apple.mobileassetd.v2"))
108         (mobile-preferences-read "com.apple.MobileAsset")))
109
110 (define-once (mobile-keybag-access)
111      (allow iokit-open
112             (iokit-user-client-class "AppleKeyStoreUserClient")))
113
114 (define-once (location-services)
115     (allow mach-lookup (with report) (with telemetry)
116            (global-name "com.apple.locationd.registration"))
117     (allow-carrier-bundle) ;; <rdar://problem/21192365>
118     (mobile-preferences-read
119         "com.apple.AppSupport"
120         "com.apple.GEO"
121         "com.apple.locationd"))
122
123 (define-once (play-audio)
124     (allow mach-lookup
125            (global-name "com.apple.audio.AURemoteIOServer"))
126     (allow mach-lookup (with report) (with telemetry)
127            (xpc-service-name "com.apple.audio.toolbox.reporting.service")))
128
129 (define-once (play-media . filters)
130     (if (not (null? filters))
131         ;; <rdar://problem/9875794>
132         (allow file-issue-extension
133             (require-all
134                 (apply require-any filters)
135                 (extension-class "com.apple.mediaserverd.read"))))
136     (allow file-issue-extension
137         (require-all
138             (extension-class "com.apple.mediaserverd.read")
139             (extension "com.apple.security.exception.files.absolute-path.read-only"
140                        "com.apple.security.exception.files.absolute-path.read-write"
141                        "com.apple.security.exception.files.home-relative-path.read-only"
142                        "com.apple.security.exception.files.home-relative-path.read-write")))
143     (allow file-issue-extension
144         (require-all
145             (extension-class "com.apple.mediaserverd.read-write")
146             (extension "com.apple.security.exception.files.absolute-path.read-write"
147                        "com.apple.security.exception.files.home-relative-path.read-write")))
148     ;; CoreMedia framework.
149     (allow mach-lookup
150            (global-name "com.apple.coremedia.admin")
151            (global-name "com.apple.coremedia.asset.xpc")
152            (global-name "com.apple.coremedia.assetimagegenerator.xpc")
153            (global-name "com.apple.coremedia.audioprocessingtap.xpc")
154            (global-name "com.apple.coremedia.capturesession")      ; Actually for video capture
155            (global-name "com.apple.coremedia.capturesource")       ; Also for video capture (<rdar://problem/15794291>).
156            (global-name "com.apple.coremedia.customurlloader.xpc") ; Needed for custom media loading
157            (global-name "com.apple.coremedia.formatreader.xpc")
158            (global-name "com.apple.coremedia.player.xpc")
159            (global-name "com.apple.coremedia.remaker")
160            (global-name "com.apple.coremedia.remotequeue")
161            (global-name "com.apple.coremedia.routediscoverer.xpc")
162            (global-name "com.apple.coremedia.routingcontext.xpc")
163            (global-name "com.apple.coremedia.samplebufferaudiorenderer.xpc")
164            (global-name "com.apple.coremedia.samplebufferrendersynchronizer.xpc")
165            (global-name "com.apple.coremedia.sandboxserver.xpc")
166            (global-name "com.apple.coremedia.systemcontroller.xpc")
167            (global-name "com.apple.coremedia.volumecontroller.xpc"))
168
169     (allow mach-lookup (with report) (with telemetry)
170         (global-name "com.apple.coremedia.cpeprotector.xpc")
171         (global-name "com.apple.coremedia.endpoint.xpc")
172         (global-name "com.apple.coremedia.figcontentkeysession.xpc")
173         (global-name "com.apple.coremedia.figcpecryptor")
174         (global-name "com.apple.coremedia.routingsessionmanager.xpc")
175         (global-name "com.apple.coremedia.sts"))
176
177     (mobile-preferences-read
178         "com.apple.avfoundation"
179         "com.apple.coreaudio"
180         "com.apple.coremedia"
181         "com.apple.corevideo"
182         "com.apple.itunesstored" ; Needed by MediaPlayer framework
183         "com.apple.mobileipod" ; Ditto
184         "com.apple.audio.virtualaudio" ; <rdar://problem/57170333>
185     )
186
187     ;; Required by the MediaPlayer framework.
188     (allow mach-lookup
189         (global-name "com.apple.audio.AudioSession"))
190
191     (allow mach-lookup (with report) (with telemetry)
192         (global-name "com.apple.airplay.apsynccontroller.xpc"))
193
194     ;; Allow mediaserverd to issue file extensions for the purposes of reading media
195     (allow file-issue-extension (require-all
196         (extension "com.apple.app-sandbox.read")
197         (extension-class "com.apple.mediaserverd.read")))
198 )
199
200 (define-once (media-remote)
201     (mobile-preferences-read
202         "com.apple.mediaremote"
203         "com.apple.mobileipod")
204     (allow mach-lookup
205            (global-name "com.apple.mediaremoted.xpc"))
206     (allow mach-lookup (with report) (with telemetry)
207         (xpc-service-name "com.apple.MediaPlayer.RemotePlayerService"))
208 )
209
210 (define-once (media-capture-support)
211     ;; Media capture, microphone access
212     (with-filter (extension "com.apple.webkit.microphone")
213         (allow device-microphone))
214
215     ;; Media capture, camera access
216     (with-filter (extension "com.apple.webkit.camera")
217         (allow user-preference-read
218             (preference-domain "com.apple.coremedia"))
219         (allow file-read* (subpath "/Library/CoreMediaIO/Plug-Ins/DAL"))
220         (allow mach-lookup (extension "com.apple.app-sandbox.mach"))
221         (allow device-camera))
222
223     ;; Support incoming video connections
224     (allow mach-lookup
225         (global-name "com.apple.coremedia.compressionsession")
226         (global-name "com.apple.coremedia.decompressionsession")
227         (global-name "com.apple.coremedia.videoqueue"))
228 )
229
230 (define-once (accessibility-support)
231     (allow mach-register
232         (local-name "com.apple.iphone.axserver"))
233     (mobile-preferences-read "com.apple.Accessibility")
234     
235     ;; <rdar://problem/10809394>
236     (deny file-write-create
237         (home-prefix "/Library/Preferences/com.apple.Accessibility.plist")
238         (with no-report))
239 )
240
241 (define-once (media-accessibility-support)
242     ;; <rdar://problem/12801477>
243     (allow mach-lookup
244         (global-name "com.apple.accessibility.mediaaccessibilityd"))
245
246     ;; <rdar://problem/12250145>
247     (mobile-preferences-read "com.apple.mediaaccessibility")
248     (mobile-preferences-read-write "com.apple.mediaaccessibility.public")
249 )
250
251 (define-once (url-translation)
252     ;; For translating http:// & https:// URLs referencing itms:// URLs.
253     ;; <rdar://problem/11587338>
254     (allow file-read*
255            (home-literal "/Library/Caches/com.apple.itunesstored/url-resolution.plist")))
256
257 ;;;
258 ;;; Declare that the application uses the OpenGL, Metal, and CoreML hardware & frameworks.
259 ;;;
260 (define-once (opengl)
261     (allow iokit-open
262            (iokit-connection "IOGPU")
263            (iokit-user-client-class
264                 "AGXCommandQueue"
265                 "AGXDevice"
266                 "AGXDeviceUserClient"
267                 "AGXSharedUserClient"
268                 "IOAccelContext"
269                 "IOAccelDevice"
270                 "IOAccelSharedUserClient"
271                 "IOAccelSubmitter2"
272                 "IOAccelContext2"
273                 "IOAccelDevice2"
274                 "IOAccelSharedUserClient2"))
275
276     (allow iokit-get-properties
277         (iokit-property "IOGLBundleName")
278         (iokit-property "IOGLESBundleName")
279         (iokit-property "IOGLESDefaultUseMetal")
280         (iokit-property "IOGLESMetalBundleName")
281         (iokit-property "MetalPluginClassName")
282         (iokit-property "MetalPluginName")
283     )
284
285     (allow sysctl-read
286            (sysctl-name #"kern.bootsessionuuid"))
287
288     (allow mach-lookup (with report) (with telemetry)
289         (xpc-service-name-prefix "com.apple.AGXCompilerService"))
290
291     (allow mach-lookup
292        ;; <rdar://problem/47268166>
293        (xpc-service-name "com.apple.MTLCompilerService"))
294     
295     (mobile-preferences-read
296         "com.apple.Metal" ;; <rdar://problem/25535471>
297         "com.apple.opengl" ;; <rdar://problem/23321675>
298     )
299 )
300
301 (define-once (debugging-support)
302         (allow file-read* file-map-executable
303                (subpath "/Developer"))
304
305         (allow ipc-posix-shm
306                (ipc-posix-name-regex #"^stack-logs")
307                (ipc-posix-name-regex #"^OA-")
308                (ipc-posix-name-regex #"^/FSM-"))
309
310         (allow ipc-posix-shm-read* ipc-posix-shm-write-data ipc-posix-shm-write-unlink
311                (ipc-posix-name-regex #"^gdt-[A-Za-z0-9]+-(c|s)$"))
312
313         (with-filter (system-attribute apple-internal)
314             ;; <rdar://problem/8565035>
315             ;; <rdar://problem/23857452>
316             (allow file-read* file-map-executable
317                    (subpath "/AppleInternal")
318                    (subpath "/usr/local/lib")))
319             (with-elevated-precedence
320                 (allow file-read* file-map-executable file-issue-extension
321                    (front-user-home-subpath "/XcodeBuiltProducts")))
322
323         ;; <rdar://problem/8107758>
324         (allow file-read* file-map-executable
325                (subpath "/System/Library/Frameworks")
326                (subpath "/System/Library/PrivateFrameworks"))
327
328         ;; <rdar://problem/32544921>
329         (mobile-preferences-read "com.apple.hangtracer"))
330
331 (define-once (device-access)
332     (deny file-read* file-write*
333           (vnode-type BLOCK-DEVICE CHARACTER-DEVICE))
334
335     (allow file-read* file-write-data
336            (literal "/dev/null")
337            (literal "/dev/zero"))
338
339     (allow file-read* file-write-data file-ioctl
340            (literal "/dev/dtracehelper"))
341
342     (allow file-read*
343            (literal "/dev/random")
344            (literal "/dev/urandom"))
345     ;; <rdar://problem/14215718>
346     (deny file-write-data (with no-report)
347           (literal "/dev/random")
348           (literal "/dev/urandom"))
349
350     (allow file-read* file-write-data file-ioctl
351            (literal "/dev/aes_0")))
352
353 (define-once (awd-log-directory daemon-name)
354     (let*
355         ((base-directory (home-relative-path "/Library/Logs/awd")))
356         (allow-create-directory (literal base-directory))
357         (allow file-read* file-write*
358             (prefix (string-append base-directory "/awd-" daemon-name ".log")))
359         (allow mach-lookup (with report) (with telemetry)
360                (global-name "com.apple.awdd"))))
361
362 (define-once (logd-diagnostic-paths)
363     (require-any
364         (subpath "/private/var/db/diagnostics")
365         (subpath "/private/var/db/timesync")
366         (subpath "/private/var/db/uuidtext")
367         (subpath "/private/var/userdata/diagnostics")))
368 (define-once (logd-diagnostic-client)
369     (with-filter
370         (require-all
371             (require-any
372                 (require-entitlement "com.apple.private.logging.diagnostic")
373                 (require-entitlement "com.apple.diagnosticd.diagnostic"))
374             (extension "com.apple.logd.read-only"))
375         (allow file-read*
376                (logd-diagnostic-paths))))
377
378 (define required-etc-files
379   (literal "/private/etc/fstab"
380            "/private/etc/hosts"
381            "/private/etc/group"
382            "/private/etc/passwd"
383            "/private/etc/protocols"
384            "/private/etc/services"))
385
386 (define-once (speech-synthesis-and-voiceover)
387     ;; Speak Selection & VoiceOver
388     ;; <rdar://problem/12030530> AX: Sandbox violation with changing Language while VO is on
389     ;; and <rdar://problem/13071747>
390     (mobile-preferences-read
391         "com.apple.SpeakSelection" ; Needed for WebSpeech
392         "com.apple.VoiceOverTouch" ; Needed for non-US english language synthesis
393         "com.apple.voiceservices") ; Ditto
394
395     ;; <rdar://problem/14555119> Access to high quality speech voices
396     ;; Needed for WebSpeech
397     (allow file-read*
398         (home-subpath "/Library/VoiceServices/Assets")
399         (home-subpath "/Library/Assets/com_apple_MobileAsset_VoiceServicesVocalizerVoice"))
400 )
401
402 (define-once (core-motion)
403     ;; CoreMotion
404     (mobile-preferences-read "com.apple.CoreMotion")
405
406     ;; CoreMotion’s deviceMotion API
407     (with-filter
408         (require-any
409             (iokit-registry-entry-class "AppleOscarNub")
410             (iokit-registry-entry-class "AppleSPUHIDInterface"))
411         (allow iokit-get-properties
412             (iokit-property "gyro-interrupt-calibration")))
413     (with-filter
414         (iokit-registry-entry-class "IOHIDEventServiceFastPathUserClient")
415         (allow iokit-open)
416         (allow iokit-get-properties iokit-set-properties
417             (iokit-property "interval"
418                             "mode"
419                             "QueueSize"
420                             "useMag"))
421         (allow iokit-get-properties
422             (iokit-property "client")))
423 )
424
425 ;; Things required by UIKit
426 (define-once (uikit-requirements)
427     (mobile-preferences-read
428         "com.apple.UIKit"
429         "com.apple.WebUI"
430         "com.apple.airplay"
431         "com.apple.avkit"
432         "com.apple.coreanimation"
433         "com.apple.mt"
434         "com.apple.preferences.sounds")
435
436     (allow mach-lookup (with report) (with telemetry)
437         (global-name "com.apple.frontboard.systemappservices")                 ; -[UIViewServiceInterface _createProcessAssertion] -> SBSProcessIDForDisplayIdentifier()
438         (global-name "com.apple.iohideventsystem")
439     )
440
441     (allow mach-lookup
442         (global-name "com.apple.CARenderServer"))
443
444     (allow mach-lookup (with report) (with telemetry)
445         (global-name-regex #"^com\.apple\.uikit\.viewservice\..+")
446         (xpc-service-name-regex #"\.apple-extension-service$") ;; <rdar://problem/19525887>
447         (xpc-service-name-regex #"\.viewservice$") ;; <rdar://problem/31252371>
448     )
449
450     ; UIKit-required IOKit nodes.
451     (allow iokit-open
452         (iokit-user-client-class "AppleJPEGDriverUserClient")
453         (iokit-user-client-class "IOSurfaceAcceleratorClient")
454         (iokit-user-client-class "IOSurfaceSendRight")
455         ;; Requires by UIView -> UITextMagnifierRenderer -> UIWindow
456         (iokit-user-client-class "IOSurfaceRootUserClient"))
457
458     ;; Silence sandbox violations from apps trying to create the empty plist if it doesn't exist.
459     ;; <rdar://problem/13796537>
460     (deny file-write-create
461         (home-prefix "/Library/Preferences/com.apple.UIKit.plist")
462         (with no-report))
463 )
464
465 (define-once (dictionary-support)
466     ; Dictionary Services used by UITextFields.
467     ; <rdar://problem/9386926>
468     (allow-create-directory
469         (home-literal "/Library/Caches/com.apple.DictionaryServices"))
470
471     ; <rdar://problem/8548856> Sub-TLF: Sandbox change for apps for read-only access to the dictionary directory/data
472     (allow file-read*
473         ; XXX - /Library ought to be allowed in all UI profiles but isn't (CF, MobileSafari)
474         (subpath "/Library/Dictionaries")
475         (home-subpath "/Library/Dictionaries"))
476 )
477
478 (define-once (network-extensions-support)
479     ;; Network Extensions / VPN helper.
480     (allow mach-lookup (with report) (with telemetry)
481         (global-name "com.apple.nehelper")
482         (global-name "com.apple.nesessionmanager.content-filter")) ;; <rdar://problem/48442387>
483 )
484
485 (deny file-map-executable)
486
487 (deny file-write-mount file-write-unmount)
488
489 (allow file-read-metadata (with no-times)
490        (vnode-type DIRECTORY))
491 (with-filter (apple-signed-executable?)
492   (allow file-read-metadata
493          (vnode-type DIRECTORY)))
494
495 (with-filter (apple-signed-executable?)
496   (managed-configuration-read "CloudConfigurationDetails.plist")
497   (managed-configuration-read "CloudConfigurationSetAsideDetails.plist")
498   (mobile-preferences-read "com.apple.security"))
499
500 (with-filter (system-attribute apple-internal)
501   (mobile-preferences-read "com.apple.PrototypeTools"))
502
503 (with-elevated-precedence
504     (allow file-read*
505            (subpath "/usr/lib"
506                     "/usr/share"
507                     "/private/var/db/timezone"))
508     (allow-read-and-issue-generic-extensions
509         (subpath "/Library/RegionFeatures"
510                  "/System/Library"))
511     (allow file-issue-extension
512         (require-all
513             (extension-class "com.apple.mediaserverd.read")
514             (subpath "/System/Library")))
515     (let ((hw-identifying-paths
516             (require-any
517                 (literal "/System/Library/Caches/apticket.der")
518                 (subpath "/System/Library/Caches/com.apple.kernelcaches")
519                 (subpath "/System/Library/Caches/com.apple.factorydata"))))
520         (deny file-issue-extension file-read* hw-identifying-paths))
521     
522     (allow file-map-executable
523            (subpath "/System/Library")
524            (subpath "/usr/lib"))
525     (allow file-read-metadata
526            (vnode-type SYMLINK))
527
528     ;;; <rdar://problem/24144418>
529     (allow file-read*
530            (subpath "/private/var/preferences/Logging"))
531
532     (mobile-preferences-read "kCFPreferencesAnyApplication")
533     (allow file-read*
534            (front-user-home-literal "/Library/Preferences/.GlobalPreferences.plist"))
535
536     (allow file-read*
537            (literal "/private/var/Managed Preferences/mobile/.GlobalPreferences.plist"))
538     (allow managed-preference-read (preference-domain "kCFPreferencesAnyApplication"))
539
540     (allow file-read-metadata
541            (home-literal "/Library/Caches/powerlog.launchd"))
542
543     (allow-read-and-issue-generic-extensions (executable-bundle))
544     (allow file-map-executable (executable-bundle))
545
546     ;; <rdar://problem/13963294>
547     (deny file-read-data file-issue-extension file-map-executable
548         (require-all
549             (executable-bundle)
550             (regex #"/[^/]+/SC_Info/")))
551
552     (unless (defined? 'restrictive-extension)
553         (with-filter
554             (extension
555                 "com.apple.app-sandbox.read"
556                 "com.apple.app-sandbox.read-write"
557                 "com.apple.quicklook.readonly"
558                 "com.apple.security.exception.files.absolute-path.read-only"
559                 "com.apple.security.exception.files.absolute-path.read-write"
560                 "com.apple.security.exception.files.home-relative-path.read-only"
561                 "com.apple.security.exception.files.home-relative-path.read-write"
562                 "com.apple.sharing.airdrop.readonly")
563             (allow file-read* file-read-metadata)
564             (allow file-issue-extension
565                    (extension-class "com.apple.app-sandbox.read"
566                                     "com.apple.mediaserverd.read"
567                                     "com.apple.quicklook.readonly"
568                                     "com.apple.sharing.airdrop.readonly")))
569         (with-filter
570             (extension
571                 "com.apple.app-sandbox.read-write"
572                 "com.apple.security.exception.files.absolute-path.read-write"
573                 "com.apple.security.exception.files.home-relative-path.read-write")
574             (allow file-write*)
575             (allow file-issue-extension
576                    (extension-class "com.apple.app-sandbox.read-write"
577                                     "com.apple.mediaserverd.read-write"))))
578
579     ;; <rdar://problem/16079361>
580     (with-filter (global-name-prefix "")
581         (allow mach-register
582                (extension "com.apple.security.exception.mach-register.global-name")))
583     (with-filter (local-name-prefix "")
584         (allow mach-register
585                (extension "com.apple.security.exception.mach-register.local-name")))
586     (allow-read-and-issue-generic-extensions
587            (extension "com.apple.security.exception.files.absolute-path.read-only")
588            (extension "com.apple.security.exception.files.home-relative-path.read-only"))
589     (allow-read-write-and-issue-generic-extensions
590            (extension "com.apple.security.exception.files.absolute-path.read-write")
591            (extension "com.apple.security.exception.files.home-relative-path.read-write"))
592     (allow iokit-open
593            (extension "com.apple.security.exception.iokit-user-client-class"))
594     (allow managed-preference-read
595            (extension "com.apple.security.exception.managed-preference.read-only"))
596     (allow user-preference-read
597            (extension "com.apple.security.exception.shared-preference.read-only"))
598     (allow user-preference-read user-preference-write
599            (extension "com.apple.security.exception.shared-preference.read-write"))
600
601     (allow file-issue-extension
602           (require-all
603               (extension-class "com.apple.nsurlstorage.extension-cache")
604               (extension "com.apple.security.exception.files.home-relative-path.read-write")
605               (require-any
606                   (prefix "/private/var/root/Library/Caches/")
607                   (front-user-home-prefix "/Library/Caches/"))))
608 )
609
610 (debugging-support)
611
612 (allow file-read*
613     required-etc-files
614     (literal "/"))
615
616 (allow file-read*
617        (subpath "/private/var/MobileAsset/PreinstalledAssetsV2/InstallWithOs"))
618
619 (device-access)
620
621 (allow file-issue-extension
622     (require-all
623         (extension-class "com.apple.app-sandbox.read-write" "com.apple.app-sandbox.read")
624         (extension "com.apple.fileprovider.read-write")))
625
626 (allow mach-lookup
627     (global-name "com.apple.logd")
628     (global-name "com.apple.logd.events")
629     (global-name "com.apple.distributed_notifications@1v3")
630     (global-name "com.apple.aggregated")
631     (global-name "com.apple.cfprefsd.daemon"))
632
633 (allow mach-lookup (with report) (with telemetry)
634     (global-name "com.apple.tccd"))
635
636 (allow ipc-posix-shm-read*
637        (ipc-posix-name-prefix "apple.cfprefs."))
638  
639 (allow mach-lookup (with report) (with telemetry)
640     (global-name "com.apple.lsd.open")
641     (global-name "com.apple.lsd.mapdb"))
642
643 ;; <rdar://problem/12413942>
644 (allow file-read*
645        (well-known-system-group-container-literal "/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist"))
646 (allow iokit-get-properties
647        (iokit-property "IORegistryEntryPropertyKeys"))
648
649 (allow ipc-posix-sem-open
650        (ipc-posix-name "containermanagerd.fb_check"))
651
652 (with-filter (ipc-posix-name "purplebuddy.sentinel")
653     (deny ipc-posix-sem-create ipc-posix-sem-post ipc-posix-sem-unlink ipc-posix-sem-wait)
654     (allow ipc-posix-sem-open))
655
656 (allow mach-lookup (with report) (with telemetry)
657     (global-name "com.apple.runningboard"))
658
659 (allow system-sched
660        (require-entitlement "com.apple.private.kernel.override-cpumon"))
661
662 (deny sysctl-read (with no-report)
663       (sysctl-name "sysctl.proc_native"))
664
665 (with-filter (system-attribute apple-internal)
666     (allow sysctl-read sysctl-write
667            (sysctl-name "vm.footprint_suspend")))
668
669 (allow mach-lookup (with report) (with telemetry)
670        (global-name "com.apple.system.logger"))
671
672 (allow file-read-metadata network-outbound
673        (literal "/private/var/run/syslog"))
674
675 (allow mach-lookup
676        (global-name "com.apple.system.notification_center"))
677 (allow ipc-posix-shm-read*
678        (ipc-posix-name "apple.shm.notification_center"))
679
680 (allow mach-lookup (with report) (with telemetry)
681     (global-name "com.apple.diagnosticd"))
682
683 (logd-diagnostic-client)
684
685 (managed-configuration-read-public)
686
687 (deny system-info (with no-report)
688       (info-type "net.link.addr"))
689
690 (allow file-read*
691        (subpath "/private/var/db/datadetectors/sys"))
692
693 (allow-well-known-system-group-container-subpath-read
694        "/systemgroup.com.apple.icloud.findmydevice.managed/Library")
695
696 (allow mach-task-name (target self))
697
698 (allow process-info-pidinfo (target self))
699 (allow process-info-pidfdinfo (target self))
700 (allow process-info-pidfileportinfo (target self))
701 (allow process-info-setcontrol (target self))
702 (allow process-info-dirtycontrol (target self))
703 (allow process-info-rusage (target self))
704 (allow process-info-codesignature (target self))
705
706 (with-filter (apple-signed-executable?)
707     (mobile-preferences-read "com.apple.demo-settings"))
708
709 ;;;
710 ;;; End common.sb content
711 ;;;
712
713 (deny mach-lookup (xpc-service-name-prefix ""))
714 (deny iokit-get-properties (with partial-symbolication))
715 (deny lsopen)
716
717 ;;;
718 ;;; The following rules were originally contained in 'UIKit-apps.sb'. We are duplicating them here so we can
719 ;;; remove unneeded sandbox extensions.
720 ;;;
721
722 ;; Any app can play audio & movies.
723 (play-audio)
724 (play-media)
725
726 ;; Access to media controls
727 (media-remote)
728
729 (url-translation)
730
731 ;; TextInput framework
732 (allow mach-lookup (with report) (with telemetry)
733     (global-name "com.apple.TextInput"))
734
735 (mobile-preferences-read "com.apple.da")
736
737 (speech-synthesis-and-voiceover)
738
739 (allow mach-lookup (with report) (with telemetry)
740     (global-name "com.apple.audio.AudioComponentRegistrar"))
741
742 ;; Permit reading assets via MobileAsset framework.
743 (asset-access 'with-media-playback)
744
745 (network-extensions-support)
746
747 ;; allow 3rd party applications to access nsurlstoraged's top level domain data cache
748 (allow-well-known-system-group-container-literal-read
749     "/systemgroup.com.apple.nsurlstoragedresources/Library/dafsaData.bin")
750
751 ;; Access the keyboards
752 (allow file-read*
753     (home-subpath "/Library/Caches/com.apple.keyboards"))
754
755 ;; Power logging
756 (allow mach-lookup
757     (global-name "com.apple.powerlog.plxpclogger.xpc")) ;;  <rdar://problem/36442803>
758
759 (mobile-preferences-read
760     "com.apple.EmojiPreferences"
761     ; <rdar://problem/8477596> com.apple.InputModePreferences
762     "com.apple.InputModePreferences"
763     ; <rdar://problem/8206632> Weather(1038) deny file-read-data ~/Library/Preferences/com.apple.keyboard.plist
764     "com.apple.keyboard"
765     ; <rdar://problem/9384085>
766     "com.apple.Preferences"
767     "com.apple.lookup.shared" ; Needed for DataDetector (Spotlight) support
768 )
769
770 ;; Silently deny unnecessary accesses caused by MessageUI framework.
771 ;; This can be removed once <rdar://problem/47038102> is resolved.
772 (deny file-read*
773     (home-literal "/Library/Preferences/com.apple.mobilemail.plist")
774     (with no-log))
775
776 ;; <rdar://problem/12985925> Need read access to /var/mobile/Library/Fonts to all apps
777 (allow file-read*
778     (home-subpath "/Library/Fonts"))
779
780 ;; <rdar://problem/7344719&26323449> LaunchServices app icons
781 (allow file-read*
782     (well-known-system-group-container-subpath "/systemgroup.com.apple.lsd.iconscache"))
783 (allow mach-lookup (with report) (with telemetry)
784     (xpc-service-name "com.apple.iconservices")
785     (global-name "com.apple.iconservices"))
786
787 (allow-preferences-common)
788
789 (core-motion)
790
791 ;; Home Button
792 (with-filter (iokit-registry-entry-class "IOPlatformDevice")
793     (allow iokit-get-properties
794         (iokit-property "home-button-type")))
795
796 (uikit-requirements)
797
798 ;; <rdar://problem/9404009>
799 (mobile-preferences-read "kCFPreferencesAnyApplication")
800
801 (dictionary-support)
802
803 ; <rdar://problem/8440231>
804 (allow file-read*
805     (home-literal "/Library/Caches/DateFormats.plist"))
806 ; Silently deny writes when CFData attempts to write to the cache directory.
807 (deny file-write*
808     (home-literal "/Library/Caches/DateFormats.plist")
809     (with no-log))
810
811 (framebuffer-access)
812
813 ;; <rdar://problem/7822790>
814 (mobile-keybag-access)
815
816 ; <rdar://problem/7595408> , <rdar://problem/7643881>
817 (opengl)
818
819 (location-services)
820
821 ; CRCopyRestrictionsDictionary periodically tries to CFPreferencesAppSynchronize com.apple.springboard.plist
822 ; which will attempt to create the plist if it doesn't exist -- from any application.  Only SpringBoard is
823 ; allowed to write its plist; ignore all others, they don't know what they are doing.
824 ; See <rdar://problem/9375027> for sample backtraces.
825 (deny file-write*
826     (home-prefix "/Library/Preferences/com.apple.springboard.plist")
827     (with no-log))
828
829 ;; <rdar://problem/34986314>
830 (mobile-preferences-read "com.apple.indigo")
831
832 ;;;
833 ;;; End UIKit-apps.sb content
834 ;;;
835
836 (deny sysctl*)
837 (allow sysctl-read
838     (sysctl-name
839         "hw.activecpu"
840         "hw.availcpu"
841         "hw.cachelinesize"
842         "hw.cputype"
843         "hw.l2cachesize"
844         "hw.logicalcpu"
845         "hw.logicalcpu_max"
846         "hw.ncpu"
847         "hw.machine"
848         "hw.memsize"
849         "hw.model"
850         "hw.pagesize_compat"
851         "hw.physicalcpu"
852         "hw.physicalcpu_max"
853         "kern.bootargs"
854         "kern.hostname"
855         "kern.memorystatus_level"
856         "kern.osproductversion"
857         "kern.osrelease"
858         "kern.osvariant_status"
859         "kern.secure_kernel"
860         "kern.version"
861         "vm.footprint_suspend"))
862
863 (allow iokit-get-properties
864     (iokit-property-regex #"^AAPL,(DisplayPipe|OpenCLdisabled|IOGraphics_LER(|_RegTag_1|_RegTag_0|_Busy_2)|alias-policy|boot-display|display-alias|mux-switch-state|ndrv-dev|primary-display|slot-name)")
865     (iokit-property "APTDevice")
866     (iokit-property "AVCSupported")
867     (iokit-property-regex #"^AppleJPEG(NumCores|Supports(AppleInterchangeFormats|MissingEOI|RSTLogging))")
868     (iokit-property "BaseAddressAlignmentRequirement")
869     (iokit-property-regex #"^DisplayPipe(PlaneBaseAlignment|StrideRequirements)")
870     (iokit-property "HEVCSupported")
871     (iokit-property-regex #"IOGVA(BGRAEnc|Codec|EncoderRestricted|Scaler)")
872     (iokit-property "IOClassNameOverride")
873     (iokit-property "IOPlatformUUID")
874     (iokit-property "IOSurfaceAcceleratorCapabilitiesDict")
875     (iokit-property "Protocol Characteristics")
876     (iokit-property "als-colorCfg") ;; <rdar://problem/52903475>
877     (iokit-property "artwork-device-idiom") ;; <rdar://problem/49497720>
878     (iokit-property "artwork-device-subtype")
879     (iokit-property "artwork-display-gamut") ;; <rdar://problem/49497788>
880     (iokit-property "artwork-dynamic-displaymode") ;; <rdar://problem/49497720>
881     (iokit-property "artwork-scale-factor") ;; <rdar://problem/49497788>
882     (iokit-property-regex #"(canvas-height|canvas-width)")
883     (iokit-property "chip-id") ;; <rdar://problem/52903477>
884     (iokit-property "class-code")
885     (iokit-property "color-accuracy-index")
886     (iokit-property "compatible") ;; <rdar://problem/47523516>
887     (iokit-property "compatible-device-fallback") ;; <rdar://problem/49497720>
888     (iokit-property "device-colors") ;; <rdar://problem/51322072>
889     (iokit-property "device-id")
890     (iokit-property "device-perf-memory-class")
891     (iokit-property "display-corner-radius") ;; <rdar://problem/50602737>
892     (iokit-property "emu")
893     (iokit-property "graphics-featureset-class") ;; <rdar://problem/49497720>
894     (iokit-property "graphics-featureset-fallbacks") ;; <rdar://problem/51322072>
895     (iokit-property "hdcp-hoover-protocol")
896     (iokit-property "iommu-present")
897     (iokit-property "oled-display") ;; <rdar://problem/51322072>
898     (iokit-property "product-description") ;; <rdar://problem/49497788>
899     (iokit-property "product-id")
900     (iokit-property "region-info") ;; <rdar://problem/52903475>
901     (iokit-property "regulatory-model-number") ;; <rdar://problem/52903475>
902     (iokit-property "soc-generation") ;; <rdar://problem/52903476>
903     (iokit-property "software-behavior")
904     (iokit-property "vendor-id")
905     (iokit-property "udid-version") ;; <rdar://problem/52903475>
906     (iokit-property "ui-pip") ;; <rdar://problem/48867037>
907 )
908
909 ;; Read-only preferences and data
910 (mobile-preferences-read
911     "com.apple.LaunchServices"
912     "com.apple.WebFoundation"
913     "com.apple.avfoundation.frecents" ;; <rdar://problem/33137029>
914     "com.apple.avfoundation.videoperformancehud" ;; <rdar://problem/31594568>
915     "com.apple.voiceservices.logging")
916
917 ;; Sandbox extensions
918 (define (apply-read-and-issue-extension op path-filter)
919     (op file-read* path-filter)
920     (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read") path-filter)))
921 (define (apply-write-and-issue-extension op path-filter)
922     (op file-write* path-filter)
923     (op file-issue-extension (require-all (extension-class "com.apple.app-sandbox.read-write") path-filter)))
924 (define (read-only-and-issue-extensions path-filter)
925     (apply-read-and-issue-extension allow path-filter))
926 (define (read-write-and-issue-extensions path-filter)
927     (apply-read-and-issue-extension allow path-filter)
928     (apply-write-and-issue-extension allow path-filter))
929 (read-only-and-issue-extensions (extension "com.apple.app-sandbox.read"))
930 (read-write-and-issue-extensions (extension "com.apple.app-sandbox.read-write"))
931
932 ;; Access to client's cache folder & re-vending to CFNetwork.
933 (allow file-issue-extension (require-all
934     (extension "com.apple.app-sandbox.read-write")
935     (extension-class "com.apple.nsurlstorage.extension-cache")))
936
937 (accessibility-support)
938
939 (media-accessibility-support)
940
941 ;; Remote Web Inspector
942 (allow mach-lookup
943        (global-name "com.apple.webinspector"))
944
945 ;; Various services required by CFNetwork and other frameworks
946 (allow mach-lookup
947     (global-name "com.apple.PowerManagement.control")
948     (global-name "com.apple.analyticsd"))
949
950 (deny file-write-create (vnode-type SYMLINK))
951 (deny file-read-xattr file-write-xattr (xattr-regex #"^com\.apple\.security\.private\."))
952
953 ;; Allow loading injected bundles.
954 (allow file-map-executable)
955
956 ;; AWD logging
957 (awd-log-directory "com.apple.WebKit.WebContent")
958
959 ;; Allow ManagedPreference access
960 (allow file-read* (literal "/private/var/Managed Preferences/mobile/com.apple.webcontentfilter.plist"))
961
962 (allow file-read-data
963     (literal "/usr/local/lib/log") ; <rdar://problem/36629495>
964 )
965
966 (allow mach-lookup
967     (require-all
968         (extension "com.apple.webkit.extension.mach")
969         (global-name "com.apple.iphone.axserver-systemwide" "com.apple.tccd" "com.apple.AGXCompilerService" "com.apple.nehelper" "com.apple.nesessionmanager.content-filter" "com.apple.uikit.viewservice.com.apple.WebContentFilter.remoteUI")))
970
971 (media-capture-support)
972
973 ;; These services have been identified as unused during living-on.
974 ;; This list overrides some definitions above and in common.sb.
975 ;; FIXME: remove overridden rules once the final list has been
976 ;; established, see https://bugs.webkit.org/show_bug.cgi?id=193840
977 (deny mach-lookup
978     (global-name "com.apple.webkit.camera")
979 )
980
981 (when (defined? 'syscall-unix)
982     (deny syscall-unix (with send-signal SIGKILL))
983     (allow syscall-unix
984         (syscall-number SYS_exit)
985         (syscall-number SYS_read)
986         (syscall-number SYS_write)
987         (syscall-number SYS_open)
988         (syscall-number SYS_close)
989         (syscall-number SYS_unlink)
990         (syscall-number SYS_chmod)
991         (syscall-number SYS_getuid)
992         (syscall-number SYS_geteuid)
993         (syscall-number SYS_recvfrom)
994         (syscall-number SYS_getpeername)
995         (syscall-number SYS_access)
996         (syscall-number SYS_dup)
997         (syscall-number SYS_pipe)
998         (syscall-number SYS_getegid)
999         (syscall-number SYS_getgid)
1000         (syscall-number SYS_sigprocmask)
1001         (syscall-number SYS_sigaltstack)
1002         (syscall-number SYS_ioctl)
1003         (syscall-number SYS_readlink)
1004         (syscall-number SYS_umask)
1005         (syscall-number SYS_msync)
1006         (syscall-number SYS_munmap)
1007         (syscall-number SYS_mprotect)
1008         (syscall-number SYS_madvise)
1009         (syscall-number SYS_fcntl)
1010         (syscall-number SYS_select)
1011         (syscall-number SYS_fsync)
1012         (syscall-number SYS_setpriority)
1013         (syscall-number SYS_socket)
1014         (syscall-number SYS_connect)
1015         (syscall-number SYS_setsockopt)
1016         (syscall-number SYS_gettimeofday)
1017         (syscall-number SYS_getrusage)
1018         (syscall-number SYS_getsockopt)
1019         (syscall-number SYS_writev)
1020         (syscall-number SYS_fchmod)
1021         (syscall-number SYS_rename)
1022         (syscall-number SYS_flock)
1023         (syscall-number SYS_sendto)
1024         (syscall-number SYS_shutdown)
1025         (syscall-number SYS_socketpair)
1026         (syscall-number SYS_mkdir)
1027         (syscall-number SYS_rmdir)
1028         (syscall-number SYS_pread)
1029         (syscall-number SYS_pwrite)
1030         (syscall-number SYS_csops)
1031         (syscall-number SYS_csops_audittoken)
1032         (syscall-number SYS_kdebug_trace64)
1033         (syscall-number SYS_kdebug_trace)
1034         (syscall-number SYS_sigreturn)
1035         (syscall-number SYS_pathconf)
1036         (syscall-number SYS_getrlimit)
1037         (syscall-number SYS_setrlimit)
1038         (syscall-number SYS_mmap)
1039         (syscall-number SYS_lseek)
1040         (syscall-number SYS_ftruncate)
1041         (syscall-number SYS_sysctl)
1042         (syscall-number SYS_mlock)
1043         (syscall-number SYS_munlock)
1044         (syscall-number SYS_getattrlist)
1045         (syscall-number SYS_getxattr)
1046         (syscall-number SYS_fgetxattr)
1047         (syscall-number SYS_listxattr)
1048         (syscall-number SYS_shm_open)
1049         (syscall-number SYS_sem_wait)
1050         (syscall-number SYS_sem_post)
1051         (syscall-number SYS_sysctlbyname)
1052         (syscall-number SYS_psynch_mutexwait)
1053         (syscall-number SYS_psynch_mutexdrop)
1054         (syscall-number SYS_psynch_cvbroad)
1055         (syscall-number SYS_psynch_cvsignal)
1056         (syscall-number SYS_psynch_cvwait)
1057         (syscall-number SYS_psynch_rw_wrlock)
1058         (syscall-number SYS_psynch_rw_unlock)
1059         (syscall-number SYS_psynch_cvclrprepost)
1060         (syscall-number SYS_process_policy)
1061         (syscall-number SYS_issetugid)
1062         (syscall-number SYS___pthread_kill)
1063         (syscall-number SYS___pthread_markcancel)
1064         (syscall-number SYS___pthread_sigmask)
1065         (syscall-number SYS___disable_threadsignal)
1066         (syscall-number SYS___semwait_signal)
1067         (syscall-number SYS_proc_info)
1068         (syscall-number SYS_stat64)
1069         (syscall-number SYS_fstat64)
1070         (syscall-number SYS_lstat64)
1071         (syscall-number SYS_getdirentries64)
1072         (syscall-number SYS_statfs64)
1073         (syscall-number SYS_fstatfs64)
1074         (syscall-number SYS_getfsstat64)
1075         (syscall-number SYS_getaudit_addr)
1076         (syscall-number SYS_bsdthread_create)
1077         (syscall-number SYS_bsdthread_terminate)
1078         (syscall-number SYS_workq_kernreturn)
1079         (syscall-number SYS_thread_selfid)
1080         (syscall-number SYS_kevent_qos)
1081         (syscall-number SYS_kevent_id)
1082         (syscall-number SYS___mac_syscall)
1083         (syscall-number SYS_read_nocancel)
1084         (syscall-number SYS_write_nocancel)
1085         (syscall-number SYS_open_nocancel)
1086         (syscall-number SYS_close_nocancel)
1087         (syscall-number SYS_sendmsg_nocancel)
1088         (syscall-number SYS_recvfrom_nocancel)
1089         (syscall-number SYS_fcntl_nocancel)
1090         (syscall-number SYS_select_nocancel)
1091         (syscall-number SYS_connect_nocancel)
1092         (syscall-number SYS_sendto_nocancel)
1093         (syscall-number SYS_fsgetpath)
1094         (syscall-number SYS_fileport_makeport)
1095         (syscall-number SYS_guarded_open_np)
1096         (syscall-number SYS_guarded_close_np)
1097         (syscall-number SYS_change_fdguard_np)
1098         (syscall-number SYS_proc_rlimit_control)
1099         (syscall-number SYS_connectx)
1100         (syscall-number SYS_getattrlistbulk)
1101         (syscall-number SYS_openat)
1102         (syscall-number SYS_openat_nocancel)
1103         (syscall-number SYS_fstatat64)
1104         (syscall-number SYS_mkdirat)
1105         (syscall-number SYS_bsdthread_ctl)
1106         (syscall-number SYS_csrctl)
1107         (syscall-number SYS_guarded_pwrite_np)
1108         (syscall-number SYS_getentropy)
1109         (syscall-number SYS_necp_open)
1110         (syscall-number SYS_necp_client_action)
1111         (syscall-number SYS_ulock_wait)
1112         (syscall-number SYS_ulock_wake)
1113         (syscall-number SYS_kdebug_typefilter)
1114         (syscall-number SYS_shared_region_check_np)
1115         (syscall-number SYS_getpid)
1116         (syscall-number SYS_bsdthread_register)
1117         (syscall-number SYS_sigaction)
1118         (syscall-number SYS_gettid)
1119         (syscall-number SYS_workq_open)
1120         (syscall-number SYS_chdir)
1121         (syscall-number SYS_memorystatus_control)
1122         (syscall-number SYS_sem_open)
1123         (syscall-number SYS_sem_close)
1124         (syscall-number SYS_fsetattrlist)
1125         (syscall-number SYS_guarded_open_dprotected_np) ; <rdar://problem/48166729>
1126         (syscall-number SYS_mremap_encrypted)
1127         (syscall-number SYS_dup2)
1128         (syscall-number SYS_fileport_makefd)
1129         (syscall-number SYS_os_fault_with_payload)
1130         (syscall-number SYS_persona)
1131         (syscall-number SYS_work_interval_ctl)
1132         (syscall-number SYS_open_dprotected_np)
1133         (syscall-number SYS_pread_nocancel)
1134         (syscall-number SYS___semwait_signal_nocancel)
1135         (syscall-number SYS_kdebug_trace_string) ;; Needed for performance sampling, see <rdar://problem/48829655>.
1136         (syscall-number SYS_fgetattrlist) ;; <rdar://problem/50266257>
1137         (syscall-number SYS_fsetxattr) ;; <rdar://problem/49795964>
1138         (syscall-number SYS_abort_with_payload) ;; <rdar://problem/50967271>
1139         (syscall-number SYS_kqueue) ;; <rdar://problem/49609201>
1140         (syscall-number SYS_kqueue_workloop_ctl) ;; <rdar://problem/50999499>
1141         (syscall-number SYS_psynch_rw_rdlock) ;; <rdar://problem/51134351>
1142         (syscall-number SYS_faccessat) ;; <rdar://problem/56998930>
1143     )
1144 )