(version 1)

(allow default)
(allow signal)
; (allow ipc-posix-shm)
; (allow process*)
; (allow mach-lookup)
; (allow sysctl-read)
(allow file-read-metadata)

; User home is forbidden.
(deny file-read*
    (subpath "/Users/vrqq")
    (subpath "/System/Volumes/Data/Users/vrqq")
)
(deny file-write*
    (subpath "/Users/vrqq")
    (subpath "/System/Volumes/Data/Users/vrqq")
)

; But FreeCAD needs its own application.
(allow file-read*
    (subpath "/Volumes/apphome/apps/FreeCAD.app")
    (subpath "/Users/vrqq/.CFUserTextEncoding")
    (subpath "/Users/vrqq/Library/Keyboard Layouts")
    (subpath "/Users/vrqq/Library/Input Methods")

    (subpath "/Users/vrqq/trusted")
    (subpath "/Users/vrqq/workingdir/fcad")
    
    (subpath "/Users/vrqq/.FreeCAD")
    (subpath "/Users/vrqq/Library/Application Support/FreeCAD")
    (subpath "/Users/vrqq/Library/Caches/FreeCAD")
    (subpath "/Users/vrqq/Library/Preferences/FreeCAD")

    (subpath "/System/Volumes/Data/Users/vrqq/.FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Application Support/FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Caches/FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Preferences/FreeCAD")   
)


(allow file-write*
    (subpath "/Volumes/apphome/apps")
    (subpath "/Users/vrqq/workingdir/fcad")

    (subpath "/Users/vrqq/.FreeCAD")
    (subpath "/Users/vrqq/Library/Application Support/FreeCAD")
    (subpath "/Users/vrqq/Library/Caches/FreeCAD")
    (subpath "/Users/vrqq/Library/Preferences/FreeCAD")

    (subpath "/System/Volumes/Data/Users/vrqq/.FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Application Support/FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Caches/FreeCAD")
    (subpath "/System/Volumes/Data/Users/vrqq/Library/Preferences/FreeCAD")
)

; ------------------------------------------------------------
; Network: completely disabled
; ------------------------------------------------------------

(deny network*)