usr/share/sandbox

webdav_agent.sb

;;; Copyright (c) 2012 Apple Inc. All rights reserved.
;;; Sandbox profile for webdav_agent.

(version 1)
(deny default)
(import "system.sb")
(import "gss-acceptor.sb")

(system-network)

(allow network-outbound)
  
(allow system-socket)

(allow mach-register
	(global-name-regex #"^com\.apple\.webdavfs\.msgport..*"))

(allow file-read-metadata
	(literal "/private/tmp"))

(allow mach-lookup 
	(global-name-regex #"^com\.apple\.webdavfs\.msgport..*"))
	
(allow mach-lookup 
	(global-name "com.apple.networkd"))

(allow file*
	(regex #"^/private/tmp/.webdavUDS\..+"))

(allow file* 
	(regex #"^/private/tmp/\.webdavcache\..+"))
	
(allow file-read*
	(regex #"^.*/Library/Preferences/com\.apple\.security\.plist"))