Sandbox/OS X Rule Set: Difference between revisions

Sandbox/OS X Rule Set (view source)

25 bytes removed , 3 May 2016

system.sb

202

edits

@@ Line 45: / Line 45: @@
 |
 <pre style="border:none;">(import \"/System/Library/Sandbox/Profiles/system.sb\")</pre>
-This excerpt it what is enabled for us.
+This excerpt it what is enabled for us. The file also defines some macros, but they're not used in the file or by our rules. Namely "(define (system-network) ...)" and "(define (system-graphics) ...)".
+<small>
 <pre style="border:none;">
 ...
@@ Line 121: / Line 123: @@
 (allow sysctl-read)
 </pre>
+</small>
 ||
-This imports all the sandbox policy directives in the file /System/Library/Sandbox/Profiles/system.sb which ships with OS X. It includes a lot: per-PID services, file-read access for some system directories, file-write to /cores/, access to graphics hardware, lots of com.apple API's, and network I/O (might just be outbound.)
+This imports all the sandbox policy directives in the file /System/Library/Sandbox/Profiles/system.sb which ships with OS X.
 |-
 |