1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

R""(

; Allow local and remote network traffic.
(allow network* (local ip) (remote ip))

; Allow access to /etc/resolv.conf (which is a symlink to
; /private/var/run/resolv.conf).
(allow file-read-metadata
       (literal "/var")
       (literal "/etc")
       (literal "/etc/resolv.conf")
       (literal "/private/etc/resolv.conf"))

(allow file-read*
       (literal "/private/var/run/resolv.conf"))

; Allow DNS lookups.
(allow network-outbound (remote unix-socket (path-literal "/private/var/run/mDNSResponder")))
(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration"))
(allow file-read* (literal "/private/etc/hosts"))

; Allow access to trustd.
(allow mach-lookup (global-name "com.apple.trustd"))
(allow mach-lookup (global-name "com.apple.trustd.agent"))

)""