selinux-refpolicy/targeted/macros/program/thunderbird_macros.te
2005-10-21 18:05:21 +00:00

61 lines
1.6 KiB
Plaintext

#
# Thunderbird
#
# Author: Ivan Gyurdiev <ivg2@cornell.edu>
#
#######################################
# thunderbird_domain(role_prefix)
#
# FIXME: Rules were removed to centralize policy in a gnome_app macro
# A similar thing might be necessary for mozilla compiled without GNOME
# support (is this possible?).
define(`thunderbird_domain', `
# Type for program
type $1_thunderbird_t, domain, nscd_client_domain;
# Transition from user type
if (! disable_thunderbird_trans) {
domain_auto_trans($1_t, thunderbird_exec_t, $1_thunderbird_t)
}
role $1_r types $1_thunderbird_t;
# FIXME: Why does it try to do that?
dontaudit $1_thunderbird_t evolution_exec_t:file { getattr execute };
# Why is thunderbird looking in .mozilla ?
# FIXME: there are legitimate uses of invoking the browser - about -> release notes
dontaudit $1_thunderbird_t $1_mozilla_home_t:dir search;
# .kde/....gtkrc
# FIXME: support properly
dontaudit $1_thunderbird_t $1_home_t:file { getattr read };
# X, mail common stuff
x_client_domain($1_thunderbird, $1)
mail_client_domain($1_thunderbird, $1)
allow $1_thunderbird_t self:process signull;
allow $1_thunderbird_t fs_t:filesystem getattr;
# GNOME support
ifdef(`gnome.te', `
gnome_application($1_thunderbird, $1)
gnome_file_dialog($1_thunderbird, $1)
allow $1_thunderbird_t $1_gnome_settings_t:file { read write };
')
# Access ~/.thunderbird
home_domain($1, thunderbird)
# RSS feeds
can_network_client_tcp($1_thunderbird_t, http_port_t)
allow $1_thunderbird_t http_port_t:tcp_socket name_connect;
allow $1_thunderbird_t self:process { execheap execmem execstack };
')