Policy: /usr/bin/ssh, Emulation: native
        native-__sysctl: permit
        native-accept: permit
        native-break: permit
        native-close: permit
        native-connect: sockaddr eq "/dev/log" then permit
        native-connect: sockaddr match "*:22" then permit
        native-connect: sockaddr match "*:53" then permit
        native-connect: sockaddr match "/tmp/ssh-*" then permit
        native-dup2: permit
        native-dup: permit
        native-exit: permit
        native-fcntl: permit
        native-fsread: filename eq "$HOME/.ssh" then permit
        native-fsread: filename eq "/dev/arandom" then permit
        native-fsread: filename eq "/etc/hosts" then permit
        native-fsread: filename eq "/etc/krb5.conf" then permit
        native-fsread: filename eq "/etc/malloc.conf" then permit
        native-fsread: filename eq "/etc/pwd.db" then permit
        native-fsread: filename eq "/etc/resolv.conf" then permit
        native-fsread: filename eq "/etc/services" then permit
        native-fsread: filename eq "/etc/spwd.db" then deny
        native-fsread: filename eq "/etc/ssh/ssh_config" then permit
        native-fsread: filename eq "/usr/X11R6/bin/xauth" then permit
        native-fsread: filename eq "/usr/lib" then permit
        native-fsread: filename eq "/usr/libexec/ld.so" then permit
        native-fsread: filename eq "/usr/share/nls/C/libc.cat" then permit
        native-fsread: filename eq "/var/run/ld.so.hints" then permit
        native-fsread: filename match "$HOME/.ssh/*" then permit
        native-fsread: filename match "/etc/kerberosV/*" then permit
        native-fsread: filename match "/tmp/krb5*" then permit
        native-fsread: filename match "/usr/lib/*" then permit
        native-fsread: filename match "/usr/share/zoneinfo/*" then permit
        native-fsread: filename sub "" then deny[enoent]
        native-fstat: permit
        native-fstatfs: permit
        native-fswrite: filename eq "/dev/crypto" then permit
        native-fswrite: filename eq "/dev/tty" then permit
        native-fswrite: filename match "$HOME/.ssh/known_hosts" then permit
        native-getdirentries: permit
        native-getegid: permit
        native-geteuid: permit
        native-getpeername: permit
        native-getpid: permit
        native-getsockname: permit
        native-getsockopt: permit
        native-gettimeofday: permit
        native-getuid: permit
        native-ioctl: permit
        native-issetugid: permit
        native-kill: permit
        native-listen: permit
        native-lseek: permit
        native-mmap: permit
        native-mprotect: permit
        native-mquery: permit
        native-munmap: permit
        native-nanosleep: permit
        native-pipe: permit
        native-pread: permit
        native-read: permit
        native-recvfrom: permit
        native-select: permit
        native-sendto: true then permit
        native-seteuid: uname eq "$USER" then permit
        native-setsockopt: permit
        native-setuid: uname eq "$USER" then permit
        native-shutdown: permit
        native-sigaction: permit
        native-sigprocmask: permit
        native-sigreturn: permit
        native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_DGRAM" then permit
        native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_STREAM" then permit
        native-socket: sockdom eq "AF_INET6" then permit
        native-socket: sockdom eq "AF_UNIX" then permit
        native-umask: permit
        native-vfork: permit
        native-wait4: permit
        native-write: permit
        native-writev: permit