# vim:syntax=apparmor # ------------------------------------------------------------------ # # Copyright (C) 2015-2020 Mikhail Morfikov # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # ------------------------------------------------------------------ # Useful info: # http://kb.mozillazine.org/Files_and_folders_in_the_profile_-_Thunderbird # abi , include @{MOZ_LIBDIR} = /{usr/,}lib/thunderbird @{MOZ_HOMEDIR} = @{HOME}/.thunderbird @{MOZ_CACHEDIR} = @{HOME}/.cache/thunderbird @{exec_path} = @{MOZ_LIBDIR}/thunderbird{,-bin} @{exec_path} += /{usr/,}bin/thunderbird profile thunderbird @{exec_path} { include include include include include include include include include include include include include include include include ptrace peer=@{profile_name}, network inet dgram, network inet6 dgram, network inet stream, network inet6 stream, network netlink raw, # The following rules are needed only when the kernel.unprivileged_userns_clone option is set # to "1". capability sys_admin, capability sys_chroot, owner @{PROC}/@{pid}/setgroups w, owner @{PROC}/@{pid}/gid_map w, owner @{PROC}/@{pid}/uid_map w, @{exec_path} mrix, @{MOZ_LIBDIR}/thunderbird-wrapper-helper.sh rix, /{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/sed rix, /{usr/,}bin/date rix, /{usr/,}bin/tr rix, /{usr/,}bin/which rix, /{usr/,}bin/ps rPx, /{usr/,}bin/dig rix, # Thunderbird files /usr/share/thunderbird/{,**} r, /etc/thunderbird/{,**} r, # Extensions @{MOZ_LIBDIR}/extensions/{,**} r, /usr/share/mozilla/extensions/{,**} r, /usr/share/lightning/{,**} r, # Thunderbird home files owner @{MOZ_HOMEDIR}/ rw, owner "@{MOZ_HOMEDIR}/{Crash Reports,Pending Pings}/" rw, owner "@{MOZ_HOMEDIR}/Crash Reports/**" rw, owner @{MOZ_HOMEDIR}/*.*/ rw, owner @{MOZ_HOMEDIR}/*.*/** rwk, deny @{MOZ_HOMEDIR}/*.*/pepmda/ rw, deny @{MOZ_HOMEDIR}/*.*/pepmda/** rwklmx, owner @{MOZ_HOMEDIR}/profiles.ini rw, owner @{MOZ_HOMEDIR}/installs.ini rw, deny @{HOME}/.mozilla/** mrwkl, # Cache owner @{HOME}/.cache/ rw, owner @{MOZ_CACHEDIR}/{,**} rw, # Needed for system mails owner /var/mail/* rwk, owner @{HOME}/ r, owner @{HOME}/Mail/ rw, owner @{HOME}/Mail/** rwl -> @{HOME}/Mail/**, # Fix error in libglib while saving files as /usr/share/glib-2.0/schemas/gschemas.compiled r, # Spellcheck /{usr/,}bin/locale rix, # System integration /etc/mime.types r, owner @{HOME}/.config/mimeapps.list.* rw, # KDE system keyring /{usr/,}lib/@{multiarch}/qt5/plugins/kf5/org.kde.kwindowsystem.platforms/KF5WindowSystemX11Plugin.so mr, /usr/share/xul-ext/kwallet5/* r, /etc/xul-ext/kwallet5.js r, owner @{HOME}/.config/kwalletrc r, # QT5 owner @{HOME}/.config/qt5ct/{,**} r, /usr/share/qt5ct/** r, deny @{sys}/devices/system/cpu/present r, deny @{sys}/devices/system/cpu/cpufreq/policy[0-9]/cpuinfo_max_freq r, deny @{sys}/devices/system/cpu/cpu[0-9]/cache/index[0-9]/size r, owner @{PROC}/@{pid}/fd/ r, owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/statm r, owner @{PROC}/@{pid}/smaps r, deny owner @{PROC}/@{pids}/cmdline r, deny owner @{PROC}/@{pids}/environ r, owner @{PROC}/@{pid}/task/ r, owner @{PROC}/@{pid}/task/@{tid}/stat r, # To remove the following error: # GLib-GIO-WARNING **: Error creating IO channel for /proc/self/mountinfo: Permission denied # (g-file-error-quark, 2) owner @{PROC}/@{pid}/mountinfo r, owner @{PROC}/@{pid}/mounts r, deny @{PROC}/@{pid}/net/arp r, deny @{PROC}/@{pid}/net/route r, # for dig owner @{PROC}/@{pid}/task/@{tid}/comm rw, /var/lib/dbus/machine-id r, /etc/machine-id r, # TMP files /var/tmp/ r, /tmp/ r, owner /tmp/* rw, owner /tmp/thunderbird{,_*}/ rw, owner /tmp/thunderbird{,_*}/* rwk, owner /tmp/mozilla_*/ rw, owner /tmp/mozilla_*/* rw, owner /tmp/MozillaMailnews/ rw, owner /tmp/MozillaMailnews/*.msf rw, owner /tmp/Temp-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/ rw, deny /dev/ r, /dev/urandom w, /dev/shm/ r, owner /dev/shm/org.chromium.* rw, owner /dev/shm/org.mozilla.ipc.@{pid}.[0-9]* rw, /etc/fstab r, /etc/mailcap r, /usr/share/sounds/freedesktop/stereo/*.oga r, # Silencer deny /{usr/,}lib/thunderbird/** w, /{usr/,}bin/lsb_release rPx -> child-lsb_release, /{usr/,}bin/xdg-open rCx -> open, /{usr/,}bin/exo-open rCx -> open, /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open, # Needed for enigmail /usr/share/xul-ext/enigmail/{,**} r, /{usr/,}bin/gpgconf rCx -> gpg, /{usr/,}bin/gpg-connect-agent rCx -> gpg, /{usr/,}bin/gpg rCx -> gpg, /{usr/,}bin/gpgsm rCx -> gpg, # Allowed apps to open /{usr/,}lib/firefox/firefox rPUx, /{usr/,}bin/qpdfview rPUx, /{usr/,}bin/viewnior rPUx, /{usr/,}bin/engrampa rPUx, /{usr/,}bin/geany rPUx, # file_inherit owner /dev/tty[0-9]* rw, owner @{HOME}/.xsession-errors w, profile gpg { include include network inet stream, network inet6 stream, network netlink raw, /{usr/,}bin/gpgconf mr, /{usr/,}bin/gpg mr, /{usr/,}bin/gpg-connect-agent mr, /{usr/,}bin/gpgsm mr, /{usr/,}bin/gpg-agent rix, owner @{HOME}/.gnupg/ rw, owner @{HOME}/.gnupg/** rwkl -> @{HOME}/.gnupg/**, owner /tmp/nscopy.tmp w, # For encryption + signature owner /tmp/gpgOutput.* rw, # for inline pgp owner /tmp/encfile rw, owner /tmp/encfile-[0-9]* rw, # for signature generation owner /tmp/nsemail.eml w, owner /tmp/nsemail-[0-9]*.eml w, # for signature verifications owner /tmp/data.sig r, owner /tmp/data-[0-9]*.sig r, @{PROC}/@{pid}/fd/ r, # file_inherit owner /dev/tty[0-9]* rw, deny owner @{MOZ_HOMEDIR}/*.*/** rw, deny owner @{MOZ_CACHEDIR}/** rw, deny /usr/share/thunderbird/** r, deny /usr/share/sounds/freedesktop/stereo/*.oga r, deny owner /tmp/thunderbird{,_*}/* rwk, deny /dev/shm/org.chromium.* r, deny owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* rw, owner /tmp/ns* rw, } profile open { include include /{usr/,}bin/xdg-open mr, /{usr/,}bin/exo-open mr, /{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr, /{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/gawk rix, /{usr/,}bin/readlink rix, /{usr/,}bin/basename rix, owner @{HOME}/ r, owner @{run}/user/[0-9]*/ r, # Allowed apps to open /{usr/,}lib/firefox/firefox rPUx, /{usr/,}bin/qpdfview rPUx, /{usr/,}bin/viewnior rPUx, /{usr/,}bin/engrampa rPUx, /{usr/,}bin/geany rPUx, # file_inherit owner @{HOME}/.xsession-errors w, } include if exists }