(version 1) ;; permissive-open: uses (deny default) and explicitly allows the operations the ;; CLI needs, matching the restrictive-* / strict-* profiles. Keep the allow-list ;; minimal and reviewed; do not switch to (allow default). ;; ;; Keep the non-network rules in sync with sandbox-macos-permissive-proxied.sb: ;; the two profiles are intentionally identical except for their network rules ;; ("open" allows broad outbound; "proxied" routes outbound through the proxy). (deny default) ;; allow reading files from anywhere on host (allow file-read*) ;; allow exec/fork (children inherit this policy, so they stay sandboxed) (allow process-exec) (allow process-fork) ;; allow signals to self, e.g. SIGPIPE on write to closed pipe (allow signal (target self)) ;; allow read access to specific information about system ;; from https://source.chromium.org/chromium/chromium/src/+/main:sandbox/policy/mac/common.sb;l=273-319;drc=7b3962fe2e5fc9e2ee58000dc8fbf3429d84d3bd (allow sysctl-read (sysctl-name "hw.activecpu") (sysctl-name "hw.busfrequency_compat") (sysctl-name "hw.byteorder") (sysctl-name "hw.cacheconfig") (sysctl-name "hw.cachelinesize_compat") (sysctl-name "hw.cpufamily") (sysctl-name "hw.cpufrequency_compat") (sysctl-name "hw.cputype") (sysctl-name "hw.l1dcachesize_compat") (sysctl-name "hw.l1icachesize_compat") (sysctl-name "hw.l2cachesize_compat") (sysctl-name "hw.l3cachesize_compat") (sysctl-name "hw.logicalcpu_max") (sysctl-name "hw.machine") (sysctl-name "hw.ncpu") (sysctl-name "hw.nperflevels") (sysctl-name "hw.optional.arm.FEAT_BF16") (sysctl-name "hw.optional.arm.FEAT_DotProd") (sysctl-name "hw.optional.arm.FEAT_FCMA") (sysctl-name "hw.optional.arm.FEAT_FHM") (sysctl-name "hw.optional.arm.FEAT_FP16") (sysctl-name "hw.optional.arm.FEAT_I8MM") (sysctl-name "hw.optional.arm.FEAT_JSCVT") (sysctl-name "hw.optional.arm.FEAT_LSE") (sysctl-name "hw.optional.arm.FEAT_RDM") (sysctl-name "hw.optional.arm.FEAT_SHA512") (sysctl-name "hw.optional.armv8_2_sha512") (sysctl-name "hw.packages") (sysctl-name "hw.pagesize_compat") (sysctl-name "hw.physicalcpu_max") (sysctl-name "hw.tbfrequency_compat") (sysctl-name "hw.vectorunit") (sysctl-name "kern.hostname") (sysctl-name "kern.maxfilesperproc") (sysctl-name "kern.osproductversion") (sysctl-name "kern.osrelease") (sysctl-name "kern.ostype") (sysctl-name "kern.osvariant_status") (sysctl-name "kern.osversion") (sysctl-name "kern.secure_kernel") (sysctl-name "kern.usrstack64") (sysctl-name "kern.version") (sysctl-name "sysctl.proc_cputype") (sysctl-name-prefix "hw.perflevel") ) ;; allow writes only to specific paths (deny default already blocks the rest) (allow file-write* (subpath (param "TARGET_DIR")) (subpath (param "TMP_DIR")) (subpath (param "CACHE_DIR")) (subpath (string-append (param "HOME_DIR") "/.npm")) (subpath (string-append (param "HOME_DIR") "/.cache")) ;; Allow writes to included directories from --include-directories (subpath (param "INCLUDE_DIR_0")) (subpath (param "INCLUDE_DIR_1")) (subpath (param "INCLUDE_DIR_2")) (subpath (param "INCLUDE_DIR_3")) (subpath (param "INCLUDE_DIR_4")) (literal "/dev/stdout") (literal "/dev/stderr") (literal "/dev/null") (literal "/dev/ptmx") (regex #"^/dev/ttys[0-9]*$") ) ;; allow the mach services normal workflows need under deny-default: sysmond for ;; process listing (pgrep), plus DNS resolution (mDNSResponder), directory ;; services (opendirectoryd), and certificate validation (trustd/ocspd). ;; This set mirrors the deny-default profile in ;; packages/core/src/sandbox/macos/baseProfile.ts (its NETWORK_SEATBELT_PROFILE), ;; which restrictive-open reaches only implicitly via (allow network-outbound). ;; Keep this allow-list minimal and reviewed. (allow mach-lookup (global-name "com.apple.sysmond") (global-name "com.apple.system.opendirectoryd.libinfo") (global-name "com.apple.system.opendirectoryd.membership") (global-name "com.apple.bsd.dirhelper") (global-name "com.apple.SecurityServer") (global-name "com.apple.networkd") (global-name "com.apple.ocspd") (global-name "com.apple.trustd") (global-name "com.apple.trustd.agent") (global-name "com.apple.mDNSResponder") (global-name "com.apple.mDNSResponderHelper") (global-name "com.apple.SystemConfiguration.DNSConfiguration") (global-name "com.apple.SystemConfiguration.configd") ) ;; AF_SYSTEM socket used by the network stack (from baseProfile.ts) (allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2) ) ) ;; enable terminal access required by ink ;; fixes setRawMode EPERM failure (at node:tty:81:24) (allow file-ioctl (regex #"^/dev/tty.*")) ;; allow inbound network traffic (local dev/test servers, the debugger on :9229, ;; OAuth localhost callbacks) (allow network-inbound (local ip "*:*")) ;; allow binding local ports (dev/test servers, OAuth localhost listeners) (allow network-bind (local ip "*:*")) ;; allow all outbound network traffic (allow network-outbound) ;; Block Docker & container daemon UNIX domain sockets (read & write) (deny file-read* file-write* (literal "/var/run/docker.sock") (literal "/var/run/docker.sock.raw") (literal "/private/var/run/docker.sock") (literal "/private/var/run/docker.sock.raw") (subpath "/var/run/docker") (subpath "/private/var/run/docker") (subpath "/Users/Shared/.docker") (subpath (string-append (param "HOME_DIR") "/.docker/run")) (subpath (string-append (param "HOME_DIR") "/.docker/desktop")) (subpath (string-append (param "HOME_DIR") "/.colima")) (subpath (string-append (param "HOME_DIR") "/.orbstack/run")) (subpath (string-append (param "HOME_DIR") "/.rd")) ) ;; Block container CLI and daemon binaries from execution (deny process-exec (literal "/usr/local/bin/docker") (literal "/usr/local/bin/dockerd") (literal "/usr/local/bin/docker-compose") (literal "/usr/bin/docker") (literal "/opt/homebrew/bin/docker") (literal "/opt/homebrew/bin/dockerd") (literal "/opt/homebrew/bin/docker-compose") (literal "/opt/homebrew/bin/podman") (literal "/usr/local/bin/podman") (literal "/opt/homebrew/bin/colima") (literal "/usr/local/bin/colima") (literal "/opt/homebrew/bin/orb") (literal "/Applications/Docker.app/Contents/Resources/bin/docker") (subpath "/Applications/Docker.app/Contents/MacOS/") (subpath "/Applications/OrbStack.app/Contents/MacOS/") (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/") ) ;; Block com.docker.* and container manager Mach lookup / XPC services (deny mach-lookup (xpc-service-name-prefix "com.docker.") (global-name-prefix "com.docker.") (global-name-prefix "dev.kdrag0n.OrbStack") ) ;; Block Docker POSIX Shared Memory (deny ipc-posix-shm* (ipc-posix-name-prefix "docker") (ipc-posix-name-prefix "com.docker.") ) ;; Deny writing to user's Gemini CLI configuration directory and sensitive files (deny file-write* (subpath (string-append (param "HOME_DIR") "/.gemini")) (regex #"/oauth_creds\.json$") (regex #"/gemini-credentials\.json$") (regex #"/mcp-oauth-tokens\.json$") (regex #"/a2a-oauth-tokens\.json$") (regex #"/google_accounts\.json$") (regex #"/trusted_hooks\.json$") (regex #"/trustedFolders\.json$") (regex #"/policy_integrity\.json$") (regex #"/\.env($|\..*)") ) ;; Block reading sensitive credentials and environment files (deny file-read* (literal (string-append (param "HOME_DIR") "/.gemini/oauth_creds.json")) (literal (string-append (param "HOME_DIR") "/.gemini/gemini-credentials.json")) (literal (string-append (param "HOME_DIR") "/.gemini/mcp-oauth-tokens.json")) (literal (string-append (param "HOME_DIR") "/.gemini/a2a-oauth-tokens.json")) (literal (string-append (param "HOME_DIR") "/.gemini/google_accounts.json")) (literal (string-append (param "HOME_DIR") "/.gemini/trusted_hooks.json")) (literal (string-append (param "HOME_DIR") "/.gemini/trustedFolders.json")) (literal (string-append (param "HOME_DIR") "/.gemini/policy_integrity.json")) (regex #"/oauth_creds\.json$") (regex #"/gemini-credentials\.json$") (regex #"/mcp-oauth-tokens\.json$") (regex #"/a2a-oauth-tokens\.json$") (regex #"/google_accounts\.json$") (regex #"/trusted_hooks\.json$") (regex #"/trustedFolders\.json$") (regex #"/policy_integrity\.json$") (regex #"/\.env($|\..*)") )