root/fusion
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(FN-4638): complete Step 2 — add SBPL template fragments

Browse Source 
Fusion-Task-Id: FN-4638
Fusion-Task-Lineage: a6dcc3d9-b7ab-42c1-af88-c9e09f770d92
This commit is contained in:
Fusion
2026-05-15 10:59:14 -07:00
committed by gsxdsm
parent 46348683bc
commit cfc95c8ea8
1 changed files with 38 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
packages/engine/src/sandbox/sandbox-exec-profile-templates.ts Normal file
View File

@@ -0,0 +1,38 @@
export const SBPL_HEADER = `(version 1)
(deny default)`;
export const SBPL_BASE_ALLOW = `
(allow process-fork)
(allow process-exec)
(allow signal (target self))
(allow sysctl-read)
(allow mach-lookup (global-name "com.apple.system.opendirectoryd.api"))
(allow mach-lookup (global-name "com.apple.coreservices.launchservicesd"))
`;
export const SBPL_FILE_READ_BASE = `
(allow file-read* (subpath "/usr"))
(allow file-read* (subpath "/bin"))
(allow file-read* (subpath "/sbin"))
(allow file-read* (subpath "/System"))
(allow file-read* (subpath "/Library"))
(allow file-read* (subpath "/private/etc/ssl"))
(allow file-read* (literal "/private/etc/resolv.conf"))
(allow file-read* (literal "/private/var/run/resolv.conf"))
(allow file-read* (subpath "/private/var/db/timezone"))
(allow file-read* (literal "/private/etc/hosts"))
(allow file-read* (literal "/private/etc/services"))
`;
export const SBPL_TMP_WRITE = `
(allow file-write* (subpath "/private/tmp"))
`;
export const SBPL_NETWORK_DENY_ALL = `(deny network*)`;
export const SBPL_NETWORK_ALLOW_OUTBOUND = `
(allow network-outbound)
(allow network-bind)
(allow system-socket)
(deny network-bind (local ip "*:4040"))
`;