audio.sb 2.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667
  1. ; Copyright 2018 The Chromium Authors. All rights reserved.
  2. ; Use of this source code is governed by a BSD-style license that can be
  3. ; found in the LICENSE file.
  4. ; --- The contents of common.sb implicitly included here. ---
  5. ; File access.
  6. (allow file-read*
  7. (path (user-homedir-path "/Library/Caches/com.apple.coreaudio.components.plist"))
  8. (regex (user-homedir-path #"/Library/Preferences/com.apple.coreaudio.*"))
  9. (subpath "/Library/Audio/Plug-Ins")
  10. (subpath "/Library/QuickTime")
  11. (subpath "/System/Library/Components")
  12. (subpath "/System/Library/Extensions")
  13. (subpath (user-homedir-path "/Library/Audio/Plug-Ins"))
  14. )
  15. (allow device-microphone)
  16. (allow iokit-open
  17. (iokit-user-client-class "IOAudioControlUserClient")
  18. (iokit-user-client-class "IOAudioEngineUserClient")
  19. )
  20. (allow ipc-posix-shm-read* ipc-posix-shm-write-data
  21. (ipc-posix-name-regex #"^AudioIO"))
  22. ; Mach IPC.
  23. (allow mach-lookup
  24. (global-name "com.apple.audio.SystemSoundServer-OSX")
  25. (global-name "com.apple.audio.VDCAssistant")
  26. (global-name "com.apple.audio.audiohald")
  27. (global-name "com.apple.audio.coreaudiod")
  28. )
  29. (if (>= os-version 1013)
  30. (allow mach-lookup
  31. (global-name "com.apple.audio.AudioComponentRegistrar")
  32. (xpc-service-name "com.apple.audio.SandboxHelper")
  33. ))
  34. ; sysctls.
  35. (allow sysctl-read
  36. (sysctl-name "hw.optional.avx1_0")
  37. (sysctl-name "hw.optional.avx2_0")
  38. (sysctl-name "hw.optional.sse2")
  39. (sysctl-name "hw.optional.sse3")
  40. (sysctl-name "hw.optional.sse4_1")
  41. (sysctl-name "hw.optional.sse4_2")
  42. )
  43. ; This is available in 10.15+, and rolled out as a Finch experiment.
  44. (if (param-true? filter-syscalls-debug)
  45. (when (defined? 'syscall-unix)
  46. (deny syscall-unix (with send-signal SIGSYS))
  47. (allow syscall-unix
  48. (syscall-number SYS_csrctl)
  49. (syscall-number SYS_mlock)
  50. (syscall-number SYS_poll)
  51. (syscall-number SYS_proc_rlimit_control)
  52. (syscall-number SYS_psynch_cvbroad)
  53. (syscall-number SYS_psynch_cvwait)
  54. (syscall-number SYS_setsockopt)
  55. (syscall-number SYS_socketpair)
  56. (syscall-number SYS_work_interval_ctl)
  57. (syscall-number SYS_write)
  58. )))