projects / people / stevee / selinux-policy.git / blame
| Commit | Line | Data |
|---|---|---|
| 1852726f CP |
1 | ## <summary>Thunderbird email client</summary> |
| 2 | ||
| 3 | ####################################### | |
| 4 | ## <summary> | |
| bbcd3c97 | 5 | ## The per role template for the thunderbird module. |
| 1852726f CP |
6 | ## </summary> |
| 7 | ## <desc> | |
| 8 | ## <p> | |
| 9 | ## This template creates a derived domain which is used | |
| 10 | ## for the thunderbird email client. | |
| 11 | ## </p> | |
| 12 | ## <p> | |
| 13 | ## This template is invoked automatically for each user, and | |
| 14 | ## generally does not need to be invoked directly | |
| 15 | ## by policy writers. | |
| 16 | ## </p> | |
| 17 | ## </desc> | |
| 18 | ## <param name="userdomain_prefix"> | |
| 19 | ## <summary> | |
| 20 | ## The prefix of the user domain (e.g., user | |
| 21 | ## is the prefix for user_t). | |
| 22 | ## </summary> | |
| 23 | ## </param> | |
| 24 | ## <param name="user_domain"> | |
| 25 | ## <summary> | |
| 26 | ## The type of the user domain. | |
| 27 | ## </summary> | |
| 28 | ## </param> | |
| 29 | ## <param name="user_role"> | |
| 30 | ## <summary> | |
| 31 | ## The role associated with the user domain. | |
| 32 | ## </summary> | |
| 33 | ## </param> | |
| 34 | # | |
| bbcd3c97 | 35 | template(`thunderbird_per_role_template',` |
| 1852726f CP |
36 | |
| 37 | ######################################## | |
| 38 | # | |
| 39 | # Declarations | |
| 40 | # | |
| 41 | ||
| 42 | type $1_thunderbird_t; | |
| 43 | domain_type($1_thunderbird_t) | |
| 44 | domain_entry_file($1_thunderbird_t,thunderbird_exec_t) | |
| 45 | role $3 types $1_thunderbird_t; | |
| 46 | ||
| 47 | type $1_thunderbird_home_t alias $1_thunderbird_rw_t; | |
| 48 | files_poly_member($1_thunderbird_home_t) | |
| 49 | ||
| 50 | type $1_thunderbird_tmpfs_t; | |
| 51 | files_tmpfs_file($1_thunderbird_tmpfs_t) | |
| 52 | ||
| 53 | ######################################## | |
| 54 | # | |
| 55 | # Local policy | |
| 56 | # | |
| 57 | ||
| 58 | allow $1_thunderbird_t self:capability sys_nice; | |
| 59 | allow $1_thunderbird_t self:process { signal_perms setsched getsched execheap execmem execstack }; | |
| 60 | allow $1_thunderbird_t self:fifo_file { ioctl read write getattr }; | |
| 61 | allow $1_thunderbird_t self:unix_dgram_socket { create connect }; | |
| 62 | allow $1_thunderbird_t self:unix_stream_socket { create accept connect write getattr read listen bind }; | |
| 63 | allow $1_thunderbird_t self:tcp_socket create_socket_perms; | |
| 64 | allow $1_thunderbird_t self:shm { read write create destroy unix_read unix_write }; | |
| 65 | ||
| 66 | # Access ~/.thunderbird | |
| 67 | allow $1_thunderbird_t $1_thunderbird_home_t:dir manage_dir_perms; | |
| 68 | allow $1_thunderbird_t $1_thunderbird_home_t:file manage_file_perms; | |
| 69 | allow $1_thunderbird_t $1_thunderbird_home_t:lnk_file create_lnk_perms; | |
| 70 | userdom_search_user_home_dirs($1,$1_thunderbird_t) | |
| 71 | ||
| 72 | allow $1_thunderbird_t $1_thunderbird_tmpfs_t:dir rw_dir_perms; | |
| 73 | allow $1_thunderbird_t $1_thunderbird_tmpfs_t:file manage_file_perms; | |
| 74 | allow $1_thunderbird_t $1_thunderbird_tmpfs_t:lnk_file create_lnk_perms; | |
| 75 | allow $1_thunderbird_t $1_thunderbird_tmpfs_t:sock_file manage_file_perms; | |
| 76 | allow $1_thunderbird_t $1_thunderbird_tmpfs_t:fifo_file manage_file_perms; | |
| 3bb0a3ba | 77 | fs_tmpfs_filetrans($1_thunderbird_t,$1_thunderbird_tmpfs_t,{ dir file lnk_file sock_file fifo_file }) |
| 1852726f CP |
78 | |
| 79 | allow $2 $1_thunderbird_t:fd use; | |
| 80 | allow $2 $1_thunderbird_t:shm { associate getattr }; | |
| 81 | allow $2 $1_thunderbird_t:unix_stream_socket connectto; | |
| 82 | allow $1_thunderbird_t $2:fd use; | |
| 83 | allow $1_thunderbird_t $2:process sigchld; | |
| 84 | allow $1_thunderbird_t $2:unix_stream_socket connectto; | |
| 85 | ||
| 86 | # Allow the user domain to signal/ps. | |
| 87 | allow $2 $1_thunderbird_t:dir { search getattr read }; | |
| 88 | allow $2 $1_thunderbird_t:{ file lnk_file } { read getattr }; | |
| 89 | allow $2 $1_thunderbird_t:process getattr; | |
| 1852726f CP |
90 | |
| 91 | # Access ~/.thunderbird | |
| 92 | allow $2 $1_thunderbird_home_t:dir manage_dir_perms; | |
| 93 | allow $2 $1_thunderbird_home_t:file manage_file_perms; | |
| 94 | allow $2 $1_thunderbird_home_t:lnk_file create_lnk_perms; | |
| 95 | allow $2 $1_thunderbird_home_t:{ dir file lnk_file } { relabelfrom relabelto }; | |
| 96 | ||
| 97 | # Allow netstat | |
| 98 | kernel_read_network_state($1_thunderbird_t) | |
| 99 | ||
| 100 | corecmd_exec_shell($1_thunderbird_t) | |
| 101 | # Startup shellscript | |
| 102 | corecmd_exec_bin($1_thunderbird_t) | |
| 103 | ||
| c0d8c41e | 104 | corenet_non_ipsec_sendrecv($1_thunderbird_t) |
| 1852726f | 105 | corenet_tcp_sendrecv_generic_if($1_thunderbird_t) |
| c0d8c41e | 106 | corenet_tcp_sendrecv_all_nodes($1_thunderbird_t) |
| 1852726f CP |
107 | corenet_tcp_sendrecv_ipp_port($1_thunderbird_t) |
| 108 | corenet_tcp_sendrecv_ldap_port($1_thunderbird_t) | |
| 109 | corenet_tcp_sendrecv_innd_port($1_thunderbird_t) | |
| 110 | corenet_tcp_sendrecv_smtp_port($1_thunderbird_t) | |
| 111 | corenet_tcp_sendrecv_pop_port($1_thunderbird_t) | |
| 112 | corenet_tcp_sendrecv_http_port($1_thunderbird_t) | |
| 1852726f CP |
113 | corenet_tcp_connect_ipp_port($1_thunderbird_t) |
| 114 | corenet_tcp_connect_ldap_port($1_thunderbird_t) | |
| 115 | corenet_tcp_connect_innd_port($1_thunderbird_t) | |
| 116 | corenet_tcp_connect_smtp_port($1_thunderbird_t) | |
| 117 | corenet_tcp_connect_pop_port($1_thunderbird_t) | |
| 118 | corenet_tcp_connect_http_port($1_thunderbird_t) | |
| c0d8c41e CP |
119 | corenet_sendrecv_ipp_client_packets($1_thunderbird_t) |
| 120 | corenet_sendrecv_ldap_client_packets($1_thunderbird_t) | |
| 121 | corenet_sendrecv_innd_client_packets($1_thunderbird_t) | |
| 122 | corenet_sendrecv_smtp_client_packets($1_thunderbird_t) | |
| 123 | corenet_sendrecv_pop_client_packets($1_thunderbird_t) | |
| 124 | corenet_sendrecv_http_client_packets($1_thunderbird_t) | |
| 1852726f CP |
125 | |
| 126 | files_list_tmp($1_thunderbird_t) | |
| 127 | files_read_usr_files($1_thunderbird_t) | |
| 128 | files_read_etc_files($1_thunderbird_t) | |
| 129 | ||
| 130 | fs_getattr_xattr_fs($1_thunderbird_t) | |
| 131 | # Access ~/.thunderbird | |
| 132 | fs_search_auto_mountpoints($1_thunderbird_t) | |
| 133 | ||
| 134 | libs_use_shared_libs($1_thunderbird_t) | |
| 135 | libs_use_ld_so($1_thunderbird_t) | |
| 136 | ||
| 137 | miscfiles_read_fonts($1_thunderbird_t) | |
| 138 | ||
| 139 | sysnet_read_config($1_thunderbird_t) | |
| 140 | # Allow DNS | |
| 141 | sysnet_dns_name_resolve($1_thunderbird_t) | |
| 142 | ||
| 143 | userdom_manage_user_tmp_dirs($1,$1_thunderbird_t) | |
| 144 | userdom_read_user_tmp_files($1,$1_thunderbird_t) | |
| 145 | userdom_write_user_tmp_sockets($1,$1_thunderbird_t) | |
| 146 | userdom_manage_user_tmp_sockets($1,$1_thunderbird_t) | |
| 147 | # .kde/....gtkrc | |
| 148 | userdom_read_user_home_content_files($1,$1_thunderbird_t) | |
| 149 | ||
| 150 | xserver_user_client_template($1,$1_thunderbird_t,$1_thunderbird_tmpfs_t) | |
| 151 | ||
| 152 | # Transition from user type | |
| 153 | tunable_policy(`! disable_thunderbird_trans',` | |
| 154 | domain_auto_trans($2, thunderbird_exec_t, $1_thunderbird_t) | |
| 155 | ') | |
| 156 | ||
| 157 | # Access ~/.thunderbird | |
| 158 | tunable_policy(`use_nfs_home_dirs',` | |
| 159 | fs_manage_nfs_dirs($1_thunderbird_t) | |
| 160 | fs_manage_nfs_files($1_thunderbird_t) | |
| 161 | fs_manage_nfs_symlinks($1_thunderbird_t) | |
| 162 | ') | |
| 163 | ||
| 164 | tunable_policy(`use_samba_home_dirs',` | |
| 165 | fs_manage_cifs_dirs($1_thunderbird_t) | |
| 166 | fs_manage_cifs_files($1_thunderbird_t) | |
| 167 | fs_manage_cifs_symlinks($1_thunderbird_t) | |
| 168 | ') | |
| 169 | ||
| 170 | tunable_policy(`mail_read_content && use_nfs_home_dirs',` | |
| 171 | files_list_home($1_thunderbird_t) | |
| 172 | ||
| 173 | fs_list_auto_mountpoints($1_thunderbird_t) | |
| 174 | fs_read_nfs_files($1_thunderbird_t) | |
| 175 | fs_read_nfs_symlinks($1_thunderbird_t) | |
| 176 | ',` | |
| 177 | files_dontaudit_list_home($1_thunderbird_t) | |
| 178 | ||
| 179 | fs_dontaudit_list_auto_mountpoints($1_thunderbird_t) | |
| 180 | fs_dontaudit_list_nfs($1_thunderbird_t) | |
| 181 | fs_dontaudit_read_nfs_files($1_thunderbird_t) | |
| 182 | ') | |
| 183 | ||
| 184 | tunable_policy(`mail_read_content && use_samba_home_dirs',` | |
| 185 | files_list_home($1_thunderbird_t) | |
| 186 | ||
| 187 | fs_list_auto_mountpoints($1_thunderbird_t) | |
| 188 | fs_read_cifs_files($1_thunderbird_t) | |
| 189 | fs_read_cifs_symlinks($1_thunderbird_t) | |
| 190 | ',` | |
| 191 | files_dontaudit_list_home($1_thunderbird_t) | |
| 192 | ||
| 193 | fs_dontaudit_list_auto_mountpoints($1_thunderbird_t) | |
| 194 | fs_dontaudit_read_cifs_files($1_thunderbird_t) | |
| 195 | fs_dontaudit_list_cifs($1_thunderbird_t) | |
| 196 | ') | |
| 197 | ||
| 198 | tunable_policy(`mail_read_content',` | |
| 199 | userdom_list_user_tmp($1,$1_thunderbird_t) | |
| 200 | userdom_read_user_tmp_files($1,$1_thunderbird_t) | |
| 201 | userdom_read_user_tmp_symlinks($1,$1_thunderbird_t) | |
| 202 | userdom_search_user_home_dirs($1,$1_thunderbird_t) | |
| 203 | userdom_read_user_home_content_files($1,$1_thunderbird_t) | |
| 204 | userdom_read_user_home_content_symlinks($1,$1_thunderbird_t) | |
| 205 | ||
| d576ae11 | 206 | ifndef(`enable_mls',` |
| 1852726f CP |
207 | fs_search_removable($1_thunderbird_t) |
| 208 | fs_read_removable_files($1_thunderbird_t) | |
| 209 | fs_read_removable_symlinks($1_thunderbird_t) | |
| 210 | ') | |
| 211 | ',` | |
| 212 | files_dontaudit_list_tmp($1_thunderbird_t) | |
| 213 | files_dontaudit_list_home($1_thunderbird_t) | |
| 214 | ||
| 215 | fs_dontaudit_list_removable($1_thunderbird_t) | |
| e9935943 | 216 | fs_dontaudit_read_removable_files($1_thunderbird_t) |
| 1852726f CP |
217 | |
| 218 | userdom_dontaudit_list_user_tmp($1,$1_thunderbird_t) | |
| 219 | userdom_dontaudit_read_user_tmp_files($1,$1_thunderbird_t) | |
| 220 | userdom_dontaudit_list_user_home_dirs($1,$1_thunderbird_t) | |
| 221 | userdom_dontaudit_read_user_home_content_files($1,$1_thunderbird_t) | |
| 222 | ') | |
| 223 | ||
| 224 | tunable_policy(`mail_read_content && read_default_t',` | |
| 225 | files_list_default($1_thunderbird_t) | |
| 226 | files_read_default_files($1_thunderbird_t) | |
| 227 | files_read_default_symlinks($1_thunderbird_t) | |
| 228 | ',` | |
| 229 | files_dontaudit_read_default_files($1_thunderbird_t) | |
| 230 | files_dontaudit_list_default($1_thunderbird_t) | |
| 231 | ') | |
| 232 | ||
| 233 | tunable_policy(`mail_read_content && read_untrusted_content',` | |
| 234 | files_list_tmp($1_thunderbird_t) | |
| 235 | files_list_home($1_thunderbird_t) | |
| 236 | ||
| 237 | userdom_search_user_home_dirs($1,$1_thunderbird_t) | |
| 238 | userdom_list_user_untrusted_content($1,$1_thunderbird_t) | |
| 239 | userdom_read_user_untrusted_content_files($1,$1_thunderbird_t) | |
| 240 | userdom_read_user_untrusted_content_symlinks($1,$1_thunderbird_t) | |
| 241 | userdom_list_user_tmp_untrusted_content($1,$1_thunderbird_t) | |
| 242 | userdom_read_user_tmp_untrusted_content_files($1,$1_thunderbird_t) | |
| 243 | userdom_read_user_tmp_untrusted_content_symlinks($1,$1_thunderbird_t) | |
| 244 | ',` | |
| 245 | files_dontaudit_list_tmp($1_thunderbird_t) | |
| 246 | files_dontaudit_list_home($1_thunderbird_t) | |
| 247 | ||
| 248 | userdom_dontaudit_list_user_home_dirs($1,$1_thunderbird_t) | |
| 249 | userdom_dontaudit_list_user_untrusted_content($1,$1_thunderbird_t) | |
| 250 | userdom_dontaudit_read_user_untrusted_content_files($1,$1_thunderbird_t) | |
| 251 | userdom_dontaudit_list_user_tmp_untrusted_content($1,$1_thunderbird_t) | |
| 252 | userdom_dontaudit_read_user_tmp_untrusted_content_files($1,$1_thunderbird_t) | |
| 253 | ') | |
| 254 | ||
| 255 | # Manage nfs homedirs | |
| 256 | tunable_policy(`write_untrusted_content && use_nfs_home_dirs',` | |
| 257 | files_search_home($1_thunderbird_t) | |
| 258 | ||
| 259 | fs_search_auto_mountpoints($1_thunderbird_t) | |
| 260 | fs_manage_nfs_dirs($1_thunderbird_t) | |
| 261 | fs_manage_nfs_files($1_thunderbird_t) | |
| 262 | fs_manage_nfs_symlinks($1_thunderbird_t) | |
| 263 | ',` | |
| 264 | fs_dontaudit_list_auto_mountpoints($1_thunderbird_t) | |
| 265 | fs_dontaudit_manage_nfs_dirs($1_thunderbird_t) | |
| 266 | fs_dontaudit_manage_nfs_files($1_thunderbird_t) | |
| 267 | ') | |
| 268 | ||
| 269 | # Manage samba homedirs | |
| 270 | tunable_policy(`write_untrusted_content && use_samba_home_dirs',` | |
| 271 | files_search_home($1_thunderbird_t) | |
| 272 | ||
| 273 | fs_search_auto_mountpoints($1_thunderbird_t) | |
| 274 | fs_manage_cifs_dirs($1_thunderbird_t) | |
| 275 | fs_manage_cifs_files($1_thunderbird_t) | |
| 276 | fs_manage_cifs_symlinks($1_thunderbird_t) | |
| 277 | ',` | |
| 278 | fs_dontaudit_list_auto_mountpoints($1_thunderbird_t) | |
| 279 | fs_dontaudit_manage_cifs_dirs($1_thunderbird_t) | |
| 280 | fs_dontaudit_manage_cifs_files($1_thunderbird_t) | |
| 281 | ') | |
| 282 | ||
| 283 | # Manage /tmp and /home | |
| 284 | tunable_policy(`write_untrusted_content',` | |
| 285 | files_search_home($1_thunderbird_t) | |
| 286 | files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,file) | |
| 287 | files_tmp_filetrans($1_thunderbird_t,$1_untrusted_content_tmp_t,dir) | |
| 288 | ||
| 289 | userdom_manage_user_untrusted_content_files($1,$1_thunderbird_t,file) | |
| 290 | userdom_manage_user_untrusted_content_files($1,$1_thunderbird_t,dir) | |
| 291 | ',` | |
| 292 | files_dontaudit_list_home($1_thunderbird_t) | |
| 293 | files_dontaudit_list_tmp($1_thunderbird_t) | |
| 294 | ||
| 295 | userdom_dontaudit_list_user_home_dirs($1,$1_thunderbird_t) | |
| 296 | userdom_dontaudit_manage_user_tmp_dirs($1,$1_thunderbird_t) | |
| 297 | userdom_dontaudit_manage_user_tmp_files($1,$1_thunderbird_t) | |
| 298 | userdom_dontaudit_manage_user_home_content_dirs($1,$1_thunderbird_t) | |
| 299 | ') | |
| 300 | ||
| bb7170f6 | 301 | optional_policy(` |
| 1852726f CP |
302 | dbus_system_bus_client_template($1_thunderbird,$1_thunderbird_t) |
| 303 | dbus_user_bus_client_template($1,$1_thunderbird,$1_thunderbird_t) | |
| 304 | dbus_send_system_bus($1_thunderbird_t) | |
| 305 | dbus_send_user_bus($1,$1_thunderbird_t) | |
| 306 | ') | |
| 307 | ||
| bb7170f6 | 308 | optional_policy(` |
| 1852726f CP |
309 | lpd_domtrans_user_lpr($1,$1_thunderbird_t) |
| 310 | ') | |
| 311 | ||
| bb7170f6 | 312 | optional_policy(` |
| 1852726f CP |
313 | cups_read_rw_config($1_thunderbird_t) |
| 314 | ') | |
| 315 | ||
| bb7170f6 | 316 | optional_policy(` |
| 1852726f CP |
317 | gpg_domtrans_user_gpg($1,$1_thunderbird_t) |
| 318 | ') | |
| 319 | ||
| bb7170f6 | 320 | optional_policy(` |
| 1852726f CP |
321 | nis_use_ypbind($1_thunderbird_t) |
| 322 | ') | |
| 323 | ||
| 324 | ifdef(`TODO',` | |
| 325 | # FIXME: Rules were removed to centralize policy in a gnome_app macro | |
| 326 | # A similar thing might be necessary for mozilla compiled without GNOME | |
| 327 | # support (is this possible?). | |
| 328 | ||
| 329 | # FIXME: Why does it try to do that? | |
| 330 | #dontaudit $1_thunderbird_t evolution_exec_t:file { getattr execute }; | |
| 331 | ||
| 332 | # Why is thunderbird looking in .mozilla ? | |
| 333 | # FIXME: there are legitimate uses of invoking the browser - about -> release notes | |
| 334 | dontaudit $1_thunderbird_t $1_mozilla_home_t:dir search; | |
| 335 | ||
| 336 | # Start links in web browser | |
| 337 | ifdef(`mozilla.te', ` | |
| 338 | can_exec($1_thunderbird_t, shell_exec_t) | |
| 339 | domain_auto_trans($1_thunderbird_t, mozilla_exec_t, $1_mozilla_t) | |
| 340 | ') | |
| 341 | ||
| 342 | # GNOME support | |
| bb7170f6 | 343 | optional_policy(` |
| 1852726f CP |
344 | gnome_application($1_thunderbird, $1) |
| 345 | gnome_file_dialog($1_thunderbird, $1) | |
| 346 | allow $1_thunderbird_t $1_gnome_settings_t:file { read write }; | |
| 347 | ') | |
| 348 | optinal_policy(`dbus',` | |
| 349 | allow $1_t $2_dbusd_t:dbus send_msg; | |
| 350 | ifdef(`cups.te', ` | |
| 351 | allow cupsd_t $1_t:dbus send_msg; | |
| 352 | ') | |
| 353 | ') | |
| 354 | ||
| 355 | ') | |
| 356 | ') |