1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
; Copyright 2018 The Chromium Authors
; Use of this source code is governed by a BSD-style license that can be
; found in the LICENSE file.
; --- The contents of common.sb implicitly included here. ---
; File access.
(allow file-read*
(path (user-homedir-path "/Library/Caches/com.apple.coreaudio.components.plist"))
(regex (user-homedir-path #"/Library/Preferences/com.apple.coreaudio.*"))
(subpath "/Library/Audio/Plug-Ins")
(subpath "/Library/QuickTime")
(subpath "/System/Library/Components")
(subpath "/System/Library/Extensions")
(subpath (user-homedir-path "/Library/Audio/Plug-Ins"))
)
(allow device-microphone)
(allow iokit-open
(iokit-user-client-class "IOAudioControlUserClient")
(iokit-user-client-class "IOAudioEngineUserClient")
)
(allow ipc-posix-shm-read* ipc-posix-shm-write-data
(ipc-posix-name-regex #"^AudioIO"))
; Mach IPC.
(allow mach-lookup
(global-name "com.apple.audio.AudioComponentRegistrar")
(global-name "com.apple.audio.AudioSession")
(global-name "com.apple.audio.audiohald")
(global-name "com.apple.audio.coreaudiod")
(global-name "com.apple.audio.SystemSoundServer-OSX")
(global-name "com.apple.audio.VDCAssistant")
(xpc-service-name "com.apple.audio.SandboxHelper")
)
; Needed by ScreenCaptureKit.
(if (>= os-version 1300)
(begin
(allow mach-lookup (global-name "com.apple.replayd"))
(allow file-read*
(subpath "/System/Library/CoreServices/SystemAppearance.bundle")
(subpath "/System/Library/CoreServices/SystemFolderLocalizations")
)
(allow sysctl-read
(sysctl-name "hw.optional.f16c")
(sysctl-name "hw.optional.avx512bw")
)
))
; sysctls.
(allow sysctl-read
(sysctl-name "hw.optional.avx1_0")
(sysctl-name "hw.optional.avx2_0")
(sysctl-name "hw.optional.sse2")
(sysctl-name "hw.optional.sse3")
(sysctl-name "hw.optional.sse4_1")
(sysctl-name "hw.optional.sse4_2")
)
|
