(version 1)
(deny default)
(allow file-read-data file-read-metadata
  (regex "^/System/Library/ColorSync/Profiles")
  (regex "^/System/Library/Frameworks")
  (regex "^/System/Library/PrivateFrameworks")
  (regex "^/Library/Fonts$")
  (regex "^/Library/Fonts/")
  (regex "^/System/Library/Fonts$")
  (regex "^/System/Library/Fonts/")
  (regex "^/System/Library/Extensions/")
  (regex "^/Library/GPUBundles")
  (regex "^/System/Library/CoreServices")
  (regex "^@HOME_DIRECTORY@/Library/Fonts$")
  (regex "^@HOME_DIRECTORY@/Library/Fonts/")
  (regex "^/usr/share/zoneinfo/")
  (regex "^/usr/share/icu/")
  (literal "/dev/null")
  (literal "/dev/random")
  (literal "@APP_ROOT@")
  (literal "@PATH_TO_EXECUTABLE@/@EXECUTABLE@")
  (regex "^/Library/Preferences/")
  (regex "^/System/Library/CoreServices/SystemAppearance.bundle")
  (regex "^/usr/lib")
  (regex "^/etc"))
  
(allow ipc-posix-shm-read-data)

(allow file-read-metadata
  (regex "^/System$")
  (regex "^/System/Library$")
  (regex "^/System/Library/Fonts$")
  (regex "^@HOME_DIRECTORY@/Library/Fonts$")
  (regex "^/System/Library/Fonts/")
  (regex "^/Library$")
  (regex "^/Library/Fonts$")
  (regex "^/Library/Fonts/")
  (regex "^/var$"))

(allow process-exec (literal "@PATH_TO_EXECUTABLE@/@EXECUTABLE@"))
(allow mach* sysctl-read)
