From: guido@trentalancia.net (Guido Trentalancia) Date: Thu, 20 Apr 2017 03:10:37 +0200 (CEST) Subject: [refpolicy] [PATCH 29/33] thunderbird: curb on userdom permissions Message-ID: <461299180.164541.1492650637085@pim.register.it> To: refpolicy@oss.tresys.com List-Id: refpolicy.oss.tresys.com This patch curbs on userdomain file read and/or write permissions for the thunderbird application module. It aims to ensure user data confidentiality. A boolean has been introduced to revert the previous read/write behavior. This patch would greatly benefit from further testing. Signed-off-by: Guido Trentalancia --- policy/modules/contrib/thunderbird.te | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) --- refpolicy-2.20170204-orig/policy/modules/contrib/thunderbird.te 2017-02-04 19:30:47.000000000 +0100 +++ refpolicy-2.20170204/policy/modules/contrib/thunderbird.te 2017-04-20 00:17:32.256448601 +0200 @@ -5,6 +5,15 @@ policy_module(thunderbird, 2.5.0) # Declarations # +## +##

+## Determine whether thunderbird +## can manage the user home +## directories and files. +##

+## +gen_tunable(thunderbird_enable_home_dirs, false) + attribute_role thunderbird_roles; type thunderbird_t; @@ -109,14 +118,24 @@ userdom_write_user_tmp_sockets(thunderbi userdom_manage_user_tmp_dirs(thunderbird_t) userdom_manage_user_tmp_files(thunderbird_t) -userdom_manage_user_home_content_dirs(thunderbird_t) -userdom_manage_user_home_content_files(thunderbird_t) -userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file }) +userdom_manage_user_cache(thunderbird_t) +userdom_manage_user_config(thunderbird_t) +userdom_manage_user_data(thunderbird_t) +userdom_manage_user_downloads(thunderbird_t) xserver_user_x_domain_template(thunderbird, thunderbird_t, thunderbird_tmpfs_t) xserver_read_xdm_tmp_files(thunderbird_t) xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t) +tunable_policy(`thunderbird_enable_home_dirs',` + userdom_manage_user_home_content_dirs(thunderbird_t) + userdom_manage_user_home_content_files(thunderbird_t) + userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file }) +',` + userdom_dontaudit_manage_user_home_content_dirs(thunderbird_t) + userdom_dontaudit_manage_user_home_content_files(thunderbird_t) +') + tunable_policy(`use_nfs_home_dirs',` fs_manage_nfs_dirs(thunderbird_t) fs_manage_nfs_files(thunderbird_t)