docs: Add beginning of cookbook (#482)

Author: russellhancox

docs/docs/cookbook/_category_.json

@@ -0,0 +1,5 @@
+{
+  "label": "Cookbook",
+  "position": 5
+}
+

docs/docs/cookbook/cel.md

@@ -0,0 +1,14 @@
+# Common Expression Language (CEL)
+
+This page lists well-known and/or community-contributed CEL expressions.
+
+## Apps signed since X
+
+This will prevent executions of an app where the specific binary was signed
+before the provided date. This is particularly useful when attached to a
+`TEAMID` or `SIGNINGID` rule.
+
+```clike
+target.signing_time >= timestamp('2025-05-31T00:00:00Z')
+```
+

docs/docs/cookbook/faa.md

@@ -0,0 +1,98 @@
+# File-Access Authorization
+
+This page lists well-known and/or community-contributed file-access
+authorization policy fragments.
+
+## Chrome Browser Cookies
+
+This policy will prevent reads of cookies from Google Chrome, from any profile
+managed by any user, except to Chrome itself and the Spotlight indexing
+process.
+
+```xml
+<key>ChromeCookies</key>
+<dict>
+		<key>Paths</key>
+		<array>
+			<dict>
+				<key>Path</key>
+				<string>/Users/*/Library/Application Support/Google/Chrome/*/Cookies</string>
+				<key>IsPrefix</key>
+				<true/>
+			</dict>
+		</array>
+		<key>Options</key>
+		<dict>
+				<key>AllowReadAccess</key>
+				<false/>
+				<key>AuditOnly</key>
+				<false/>
+				<key>RuleType</key>
+				<string>PathsWithAllowedProcesses</string>
+		</dict>
+		<key>Processes</key>
+		<array>
+				<dict>
+					<key>SigningID</key>
+					<string>com.google.Chrome*</string>
+					<key>TeamID</key>
+					<string>EQHXZ8M8AV</string>
+				</dict>
+				<dict>
+					<key>SigningID</key>
+					<string>com.apple.mdworker_shared</string>
+					<key>PlatformBinary</key>
+					<true/>
+				</dict>
+		</array>
+</dict>
+```
+
+## Sudoers
+
+This policy prevents the sudoers config file from being modified by any process
+except sudo itself. With this installed, users will have to use
+`sudo -e /etc/sudoers` to modify the policy.
+
+```xml
+<key>Sudoers</key>
+<dict>
+		<key>Paths</key>
+		<array>
+			<dict>
+				<key>Path</key>
+				<string>/private/etc/sudoers</string>
+			</dict>
+			<dict>
+				<key>Path</key>
+				<string>/private/etc/sudoers.d/*</string>
+				<key>IsPrefix</key>
+				<true/>
+			</dict>
+			<dict>
+				<key>Path</key>
+				<string>/private/var/db/sudo/ts/*</string>
+				<key>IsPrefix</key>
+				<true/>
+			</dict>
+		</array>
+		<key>Options</key>
+		<dict>
+				<key>AllowReadAccess</key>
+				<false/>
+				<key>AuditOnly</key>
+				<false/>
+				<key>RuleType</key>
+				<string>PathsWithAllowedProcesses</string>
+		</dict>
+		<key>Processes</key>
+		<array>
+				<dict>
+					<key>SigningID</key>
+					<string>com.apple.sudo</string>
+					<key>PlatformBinary</key>
+					<true/>
+				</dict>
+		</array>
+</dict>
+```

docs/docs/cookbook/transitive.md

@@ -0,0 +1,20 @@
+# Transitive Allowlisting
+
+This page lists well-known and/or community-contributed Transitive Allowlisting
+rules for various compiler toolchains.
+
+For each toolchain it's important to note that the last binary that writes to
+the new binary is the one that should have a rule.
+
+## Xcode
+
+To cover Xcode you will either need `ld`, `lipo`, or `codesign`, depending on
+how the project is configured:
+
+* `platform:com.apple.ld`
+* `platform:com.apple.lipo`
+* `platform:com.apple.security.codesign`
+
+One important caveat: adding an `ALLOWLIST_COMPILER` rule for the codesign
+utility could potentially allow any binary to be re-signed and executed.
+