-
Notifications
You must be signed in to change notification settings - Fork 3
/
torbrowser.sb
102 lines (85 loc) · 2.82 KB
/
torbrowser.sb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
;; Tor WEB Browser Bundle sandbox
;; by Paolo Fabio Zaino
;; License GPL v2
;; Get this file and hack it to perfection ;)
(version 1)
(debug deny)
;; allow processes to traverse symlinks
(allow file-read-metadata)
(allow file-read-data file-read-metadata
(regex
; Allow reading system dylibs and frameworks
#"^/usr/lib/.*\.dylib$"
#"^/usr/lib/info/.*\.so$"
#"^/System/"
#"^/private/var/db/dyld/"
#"^(/private)?/etc/hosts\.(allow|deny)$"
))
(allow file-read-data file-write-data
(regex
; Allow files accessed by system dylibs and frameworks
#"^/dev/null$"
#"^(/private)?/var/run/syslog$"
#"^/dev/u?random$"
#"^/dev/autofs_nowait$"
#"^/dev/dtracehelper$"
#"/\.CFUserTextEncoding$"
#"^(/private)?/etc/localtime$"
#"^/usr/share/nls/"
#"^/usr/share/zoneinfo/"
))
(allow file-ioctl
(regex
; Allow access to dtracehelper by dyld
#"^/dev/dtracehelper$"))
(allow mach-lookup
(global-name "com.apple.bsd.dirhelper")
(global-name "com.apple.system.DirectoryService.libinfo_v1")
(global-name "com.apple.system.DirectoryService.membership_v1")
(global-name "com.apple.system.logger")
(global-name "com.apple.system.notification_center"))
(allow ipc-posix-shm) ; Libnotify
;; (allow sysctl-read)
(allow signal (target self))
(deny default)
(allow file-write* file-read-data file-read-metadata
(regex "^/Users/<your-username>/Downloads")
(regex "^/Users/<your-username>/Library/Application Support/Mozilla")
(regex "^/Users/<your-username>/Library/Application Support/Firefox")
(regex "^/Users/<your-username>/Library/Preferences")
(regex "^/Users/<your-username>/Library/PreferencePanes")
(regex "^/Users/<your-username>/Library/Caches/Firefox")
(regex "^/Users/<your-username>/Library/Caches/TemporaryItems")
(regex "^/Users/<your-username>/Library/Application Support/TorBrowser-Data/")
(regex "^/Library/Application Support/CrashReporter")
(regex "^/Applications/TorBrowser.app")
(regex "^(/private)?/tmp/"))
(allow file-read-data file-read-metadata
(regex "^/dev/autofs.*")
(regex "^/Library/Preferences")
(regex "^/Library/Fonts")
(regex "^/Library/Internet Plug-Ins")
(regex "^/Library/PreferencePanes")
(regex "^/usr/share/icu")
(regex "^/usr/share/locale")
(regex "^/System/Library")
(regex "^/Applications/TorBrowser.app")
(regex "^/usr/lib")
(regex "^/usr/local/lib")
(regex "^/var")
(regex "^/private/var/tmp/")
(regex "^/private/tmp/")
(regex "^/Users/<your-username>")
(regex #"Frameworks/SDL.framework"))
(allow mach* sysctl-read)
(deny file-write-data
(regex #"^(/private)?/etc/localtime$"
#"^/usr/share/nls/"
#"^/usr/share/zoneinfo/"))
;; (allow process-exec*
;; (regex "^/Applications/TorBrowser.app"))
(allow process-exec*)
(allow network*)
(allow iokit-open)
(allow ipc-posix-shm)
(allow process-fork)