; Relevant:

;

; https://developer.apple.com/documentation/apple-silicon/porting-just-in-time-compilers-to-apple-silicon

(version 1)

(deny default)

(allow process-exec (literal (param "MAIN")))

(allow file-read*)

(allow file-write* (literal "/dev/null"))

(allow file-map-executable)

(allow dynamic-code-generation)

(allow sysctl-read)

(allow network* (remote ip "localhost:*"))

(allow network* (local ip "localhost:*"))

; Allow creation of one executable file. Used in testing.

(allow file-write-create (literal (param "OUT")))

(allow file-write-data (literal (param "OUT")))

(allow file-write-mode (literal (param "OUT")))

; Fixed executables used by debugging and tests.

(allow process-fork)

(allow signal (target children))

(allow process-exec (literal (param "LLVM_MC")))

(allow process-exec (literal (param "LLVM_SYMBOLIZER")))

(allow process-exec (literal (param "ATOS")))

(allow process-exec (literal (param "TEST_CAT")))

(allow process-exec (literal (param "TEST_ECHO")))

(allow process-exec (literal (param "TEST_FALSE")))

(allow process-exec (literal (param "TEST_GREP")))

(allow process-exec (literal (param "TEST_SLEEP")))

; Bots like to use this for scratch; also `/tmp` symlinks to this.

(allow file-read* (subpath "/private/tmp"))

(allow file-write* (subpath "/private/tmp"))

; (allow file-map-executable (subpath "/private/tmp"))

; (allow process-exec (subpath "/private/tmp"))