Design

Sample policy for ssh:

Policy: /usr/bin/ssh, Emulation: native
    native-break: permit
    native-close: permit
    native-connect: sockaddr match "*:22" then permit
    native-connect: sockaddr match "*:53" then permit
    native-connect: sockaddr match "/tmp/ssh-*" then permit
    native-dup: permit
    native-exit: permit
    native-fcntl: permit
    native-fsread: filename eq "$HOME/.ssh" then permit
    native-fsread: filename eq "/dev/arandom" then permit
    native-fsread: filename match "$HOME/.ssh/*" then permit
    native-read: permit
    native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_DGRAM"
         then permit
    native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_STREAM"
         then permit
    [...]