[refpolicy] [PATCH 29/33] thunderbird: curb on userdom permissions

[refpolicy] [PATCH 29/33] thunderbird: curb on userdom permissions

[Guido Trentalancia]

This patch curbs on userdomain file read and/or write permissions
for the thunderbird application module.

It aims to ensure user data confidentiality.

A boolean has been introduced to revert the previous read/write
behavior.

This patch would greatly benefit from further testing.

Signed-off-by: Guido Trentalancia <guido@trentalancia.net>
---
 policy/modules/contrib/thunderbird.te |   25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

--- refpolicy-2.20170204-orig/policy/modules/contrib/thunderbird.te	2017-02-04 19:30:47.000000000 +0100
+++ refpolicy-2.20170204/policy/modules/contrib/thunderbird.te	2017-04-20 00:17:32.256448601 +0200
@@ -5,6 +5,15 @@ policy_module(thunderbird, 2.5.0)
 # Declarations
 #
 
+## <desc>
+##	<p>
+##	Determine whether thunderbird
+##	can manage the user home
+##	directories and files.
+##	</p>
+## </desc>
+gen_tunable(thunderbird_enable_home_dirs, false)
+
 attribute_role thunderbird_roles;
 
 type thunderbird_t;
@@ -109,14 +118,24 @@ userdom_write_user_tmp_sockets(thunderbi
 userdom_manage_user_tmp_dirs(thunderbird_t)
 userdom_manage_user_tmp_files(thunderbird_t)
 
-userdom_manage_user_home_content_dirs(thunderbird_t)
-userdom_manage_user_home_content_files(thunderbird_t)
-userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file })
+userdom_manage_user_cache(thunderbird_t)
+userdom_manage_user_config(thunderbird_t)
+userdom_manage_user_data(thunderbird_t)
+userdom_manage_user_downloads(thunderbird_t)
 
 xserver_user_x_domain_template(thunderbird, thunderbird_t, thunderbird_tmpfs_t)
 xserver_read_xdm_tmp_files(thunderbird_t)
 xserver_dontaudit_getattr_xdm_tmp_sockets(thunderbird_t)
 
+tunable_policy(`thunderbird_enable_home_dirs',`
+	userdom_manage_user_home_content_dirs(thunderbird_t)
+	userdom_manage_user_home_content_files(thunderbird_t)
+	userdom_user_home_dir_filetrans_user_home_content(thunderbird_t, { dir file })
+',`
+	userdom_dontaudit_manage_user_home_content_dirs(thunderbird_t)
+	userdom_dontaudit_manage_user_home_content_files(thunderbird_t)
+')
+
 tunable_policy(`use_nfs_home_dirs',`
 	fs_manage_nfs_dirs(thunderbird_t)
 	fs_manage_nfs_files(thunderbird_t)