(version 1)
;; PMG Sandbox Policy: render-min
;; minimal policy for render golden test
;; Generated by PMG sandbox system

(deny default (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=default|target="))

;; Essential system permissions
;; Based on Chrome/Chromium sandbox for stable process execution

;; Process permissions
(allow process-exec)
(allow process-fork)
(allow process-info* (target same-sandbox))
(allow signal (target same-sandbox))
(allow mach-priv-task-port (target same-sandbox))

;; User preferences
(allow user-preference-read)

;; Mach IPC - specific services only
(allow mach-lookup
  (global-name "com.apple.audio.systemsoundserver")
  (global-name "com.apple.distributed_notifications@Uv3")
  (global-name "com.apple.FSEvents")
  (global-name "com.apple.FontObjectsServer")
  (global-name "com.apple.fonts")
  (global-name "com.apple.logd")
  (global-name "com.apple.lsd.mapdb")
  (global-name "com.apple.PowerManagement.control")
  (global-name "com.apple.system.logger")
  (global-name "com.apple.system.notification_center")
  (global-name "com.apple.trustd.agent")
  (global-name "com.apple.system.opendirectoryd.libinfo")
  (global-name "com.apple.system.opendirectoryd.membership")
  (global-name "com.apple.bsd.dirhelper")
  (global-name "com.apple.securityd.xpc")
  (global-name "com.apple.coreservices.launchservicesd")
)

;; POSIX IPC
(allow ipc-posix-shm)  ; Shared memory
(allow ipc-posix-sem)  ; Semaphores for Python multiprocessing

;; IOKit operations
(allow iokit-open
  (iokit-registry-entry-class "IOSurfaceRootUserClient")
  (iokit-registry-entry-class "RootDomainUserClient")
  (iokit-user-client-class "IOSurfaceSendRight")
)
(allow iokit-get-properties)

;; Specific safe system socket
(allow system-socket (require-all (socket-domain AF_SYSTEM) (socket-protocol 2)))

;; sysctl - specific sysctls only
(allow sysctl-read
  (sysctl-name "hw.activecpu")
  (sysctl-name "hw.busfrequency_compat")
  (sysctl-name "hw.byteorder")
  (sysctl-name "hw.cacheconfig")
  (sysctl-name "hw.cachelinesize_compat")
  (sysctl-name "hw.cpufamily")
  (sysctl-name "hw.cpufrequency")
  (sysctl-name "hw.cpufrequency_compat")
  (sysctl-name "hw.cputype")
  (sysctl-name "hw.l1dcachesize_compat")
  (sysctl-name "hw.l1icachesize_compat")
  (sysctl-name "hw.l2cachesize_compat")
  (sysctl-name "hw.l3cachesize_compat")
  (sysctl-name "hw.logicalcpu")
  (sysctl-name "hw.logicalcpu_max")
  (sysctl-name "hw.machine")
  (sysctl-name "hw.memsize")
  (sysctl-name "hw.ncpu")
  (sysctl-name "hw.nperflevels")
  (sysctl-name "hw.packages")
  (sysctl-name "hw.pagesize_compat")
  (sysctl-name "hw.pagesize")
  (sysctl-name "hw.physicalcpu")
  (sysctl-name "hw.physicalcpu_max")
  (sysctl-name "hw.tbfrequency_compat")
  (sysctl-name "hw.vectorunit")
  (sysctl-name "kern.argmax")
  (sysctl-name "kern.bootargs")
  (sysctl-name "kern.hostname")
  (sysctl-name "kern.maxfiles")
  (sysctl-name "kern.maxfilesperproc")
  (sysctl-name "kern.maxproc")
  (sysctl-name "kern.ngroups")
  (sysctl-name "kern.osproductversion")
  (sysctl-name "kern.osrelease")
  (sysctl-name "kern.ostype")
  (sysctl-name "kern.osvariant_status")
  (sysctl-name "kern.osversion")
  (sysctl-name "kern.secure_kernel")
  (sysctl-name "kern.tcsm_available")
  (sysctl-name "kern.tcsm_enable")
  (sysctl-name "kern.usrstack64")
  (sysctl-name "kern.version")
  (sysctl-name "kern.willshutdown")
  (sysctl-name "machdep.cpu.brand_string")
  (sysctl-name "machdep.ptrauth_enabled")
  (sysctl-name "security.mac.lockdown_mode_state")
  (sysctl-name "sysctl.proc_cputype")
  (sysctl-name "vm.loadavg")
  (sysctl-name-prefix "hw.optional.arm")
  (sysctl-name-prefix "hw.optional.arm.")
  (sysctl-name-prefix "hw.optional.armv8_")
  (sysctl-name-prefix "hw.perflevel")
  (sysctl-name-prefix "kern.proc.all")
  (sysctl-name-prefix "kern.proc.pgrp.")
  (sysctl-name-prefix "kern.proc.pid.")
  (sysctl-name-prefix "machdep.cpu.")
  (sysctl-name-prefix "net.routetable.")
)

;; V8 thread calculations
(allow sysctl-write
  (sysctl-name "kern.tcsm_enable")
)

;; Distributed notifications
(allow distributed-notification-post)

;; Specific mach-lookup for security
(allow mach-lookup (global-name "com.apple.SecurityServer"))

;; Device file I/O
(allow file-ioctl (literal "/dev/null"))
(allow file-ioctl (literal "/dev/zero"))
(allow file-ioctl (literal "/dev/random"))
(allow file-ioctl (literal "/dev/urandom"))
(allow file-ioctl (literal "/dev/dtracehelper"))
(allow file-ioctl (literal "/dev/tty"))

(allow file-ioctl file-read-data file-write-data
  (require-all
    (literal "/dev/null")
    (vnode-type CHARACTER-DEVICE)
  )
)

;; File metadata for getcwd() and similar
(allow file-read-metadata)

;; System configuration and libraries
(allow file-read* (subpath "/dev"))
(allow file-read* (subpath "/etc"))

;; Filesystem access
(allow file-read* (subpath "/tmp"))

;; Auto-allow TMPDIR parent on macOS
(allow file-write* (subpath "/PMG_GOLDEN_TMPDIR"))
(allow file-write* (subpath "/private/PMG_GOLDEN_TMPDIR"))

(allow file-write* (subpath "/tmp"))



;; Mandatory security denies (credentials, git hooks, etc.)
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-write* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-write* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.env.%2A"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-write* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.aws"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-write* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-write* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-write* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-write* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-write* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-write* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-write* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-write* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-write* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-write* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-write* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2A%2A%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-write* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-write* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-write* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-write|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env"))
(deny file-read* (regex #"^(.*/)?\.env$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.env") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.env.%2A"))
(deny file-read* (regex #"^(.*/)?\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.env.%2A"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.env\.[^/]*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.env.%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.aws"))
(deny file-read* (regex #"^(.*/)?\.aws$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.aws"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.aws") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.aws"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.azure"))
(deny file-read* (regex #"^(.*/)?\.azure$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.azure") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.azure"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gcloud"))
(deny file-read* (regex #"^(.*/)?\.gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgcloud"))
(deny file-read* (regex #"^(.*/)?\.config/gcloud$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gcloud") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgcloud"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.kube"))
(deny file-read* (regex #"^(.*/)?\.kube$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.kube") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.kube"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.ssh"))
(deny file-read* (regex #"^(.*/)?\.ssh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.ssh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.ssh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.gnupg"))
(deny file-read* (regex #"^(.*/)?\.gnupg$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.gnupg") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.gnupg"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.docker%2Fconfig.json"))
(deny file-read* (regex #"^(.*/)?\.docker/config\.json$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.docker/config.json") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.docker%2Fconfig.json"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.netrc"))
(deny file-read* (regex #"^(.*/)?\.netrc$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.netrc") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.netrc"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git-credentials"))
(deny file-read* (regex #"^(.*/)?\.git-credentials$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git-credentials") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git-credentials"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.pgpass"))
(deny file-read* (regex #"^(.*/)?\.pgpass$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.pgpass") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.pgpass"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.config%2Fgh"))
(deny file-read* (regex #"^(.*/)?\.config/gh$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2A%2A%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.config/gh") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.config%2Fgh"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/config") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fconfig"))
(deny file-read* (subpath "/PMG_GOLDEN_CWD/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_CWD/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_CWD%2F.git%2Fhooks%2F%2A%2A"))
(deny file-read* (subpath "/PMG_GOLDEN_HOME/.git/hooks") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks"))
(deny file-read* (regex #"^/PMG_GOLDEN_HOME/\.git/hooks/.*$") (with message "PMG_SBX|run=PMG_SBX_GOLDENXXXXXX|kind=file-read|target=%2FPMG_GOLDEN_HOME%2F.git%2Fhooks%2F%2A%2A"))


;; Network access

;; Process execution