-
Notifications
You must be signed in to change notification settings - Fork 19
/
safari.sb
51 lines (47 loc) · 967 Bytes
/
safari.sb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
(version 1)
(debug deny)
(allow network-outbound)
(allow ipc-posix-shm)
;(allow process-exec
; (regex
; #"^/Applications/Safari.app/*"
; )
;)
(allow sysctl-read)
(allow file-read-metadata)
(allow signal)
(allow process*)
;(allow mach*)
(allow mach-lookup)
;(allow process-exec
; (regex
; #"^/System/Library/CoreServices/*"
; )
;)
;; Allow these reads:
(allow file-read*
(regex
#"^/Users/[^.]+/$"
#"^/Users/[^.]+/Downloads"
#"^/Users/[^.]+/Library"
#"^/Users/[^.]+/Public"
#"^/Users/[^.]+/Sites"
#"^/Applications/Safari.app"
#"^/Library/*"
#"^/System/Library/*"
#"^/usr/lib/*"
#"^/usr/share/*"
#"^/private/*"
#"^/dev/*"
)
)
;; Allow these writes:
(allow file-write*
(regex
#"^/Users/[^.]+/Downloads/*"
#"^/Users/[^.]+/Library/.*"
#"^/private/var/*"
#"^/dev/dtracehelper"
)
)
(deny default)