This patch curbs on userdomain file read and/or write permissions
for the thunderbird application module.
It aims to ensure user data confidentiality.
A boolean has been introduced to revert the previous read/write
behavior.
This patch would greatly benefit from further testing.
Signed-off-by: Guido Trentalancia <[email protected]>
---
policy/modules/contrib/thunderbird.te | 25 ++++++++++++++++++++++---
1 file changed, 22 insertions(+), 3 deletions(-)
--- refpolicy-2.20170204-orig/policy/modules/contrib/thunderbird.te 2017-02-04 19:30:47.000000000 +0100
+++ refpolicy-2.20170204/policy/modules/contrib/thunderbird.te 2017-04-20 00:17:32.256448601 +0200
@@ -5,6 +5,15 @@ policy_module(thunderbird, 2.5.0)
# Declarations
#
+## <desc>
+## <p>
+## Determine whether thunderbird
+## can manage the user home
+## directories and files.
+## </p>
+## </desc>
+gen_tunable(thunderbird_enable_home_dirs, false)
+
attribute_role thunderbird_roles;
type thunderbird_t;
@@ -109,14 +118,24 @@ userdom_write_user_tmp_sockets(thunderbi
userdom_manage_user_tmp_dirs(thunderbird_t)
userdom_manage_user_tmp_files(thunderbird_t)
-userdom_manage_user_home_content_dirs(thunderbird_t)
-userdom_manage_user_home_content_files(thunderbird_t)
-userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file })
+userdom_manage_user_cache(thunderbird_t)
+userdom_manage_user_config(thunderbird_t)
+userdom_manage_user_data(thunderbird_t)
+userdom_manage_user_downloads(thunderbird_t)
xserver_user_x_domain_template(thunderbird, thunderbird_t, thunderbird_tmpfs_t)
xserver_read_xdm_tmp_files(thunderbird_t)
xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
+tunable_policy(`thunderbird_enable_home_dirs',`
+ userdom_manage_user_home_content_dirs(thunderbird_t)
+ userdom_manage_user_home_content_files(thunderbird_t)
+ userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file })
+',`
+ userdom_dontaudit_manage_user_home_content_dirs(thunderbird_t)
+ userdom_dontaudit_manage_user_home_content_files(thunderbird_t)
+')
+
tunable_policy(`use_nfs_home_dirs',`
fs_manage_nfs_dirs(thunderbird_t)
fs_manage_nfs_files(thunderbird_t)