Merge lp:~sdeziel/apparmor-profiles/thunderbird-enigmail-1.9 into lp:apparmor-profiles

[Simon Déziel]

This updates the thunderbird//gpg2 profile to support the enigmail version 1.9 that landed in Xenial recently.

While at it, give thunderbird access to /usr/bin/locale that is sometimes needed.

[Seth Arnold (seth-arnold)]

Heh, I was going to complain about the /usr/bin/locale Uxr, rule but there's at least those three other Uxr rules right next to it.

I'm surprised about the silenced denials -- those seem wide-ranging and potentially problematic. I might have even thought that thunderbird should have ~/.thunderbird/** rwlk, access.

The static names in /tmp/ are interesting. Those may need more research to see if those need a CVE. (It's possible to use static names in /tmp safely, but the [0-9]* regex there gives me a bad feeling.)

Thanks

[Simon Déziel (sdeziel)]

On 2016-04-18 04:36 PM, Seth Arnold wrote:
> I'm surprised about the silenced denials -- those seem wide-ranging
> and potentially problematic. I might have even thought that
> thunderbird should have ~/.thunderbird/** rwlk, access.

The web view doesn't make it very easy to spot but those rules apply
only to the _subprofile_ gpg2.

> The static names in /tmp/ are interesting. Those may need more
> research to see if those need a CVE. (It's possible to use static
> names in /tmp safely, but the [0-9]* regex there gives me a bad
> feeling.)

When the base file already exists, a number is appended, that's only how
far I checked this.

[lp:~sdeziel/apparmor-profiles/thunderbird-enigmail-1.9]

164. By Simon Déziel on 2016-04-25

usr.bin.thunderbird: gpg2 needs read access to mountinfo

[Steve Beattie (sbeattie)]

On Mon, Apr 18, 2016 at 09:57:24PM -0000, Simon Déziel wrote:
> On 2016-04-18 04:36 PM, Seth Arnold wrote:
> > I'm surprised about the silenced denials -- those seem wide-ranging
> > and potentially problematic. I might have even thought that
> > thunderbird should have ~/.thunderbird/** rwlk, access.
>
> The web view doesn't make it very easy to spot but those rules apply
> only to the _subprofile_ gpg2.

Thanks for highlighting that.

> > The static names in /tmp/ are interesting. Those may need more
> > research to see if those need a CVE. (It's possible to use static
> > names in /tmp safely, but the [0-9]* regex there gives me a bad
> > feeling.)
>
> When the base file already exists, a number is appended, that's only how
> far I checked this.

It's a bit dubious, but looking at the gpg2 subprofile, there's other
similar dubious /tmp/ usage already.

I've merged this branch after applying the changes to the 16.10 tree as
well.

--
Steve Beattie
<email address hidden>
http://NxNW.org/~steve/

[Simon Déziel (sdeziel)]

On 2016-04-30 12:45 PM, Steve Beattie wrote:
> I've merged this branch after applying the changes to the 16.10 tree as
> well.

Thanks!

=== modified file 'ubuntu/16.04/usr.bin.thunderbird'
--- ubuntu/16.04/usr.bin.thunderbird	2016-04-05 20:06:07 +0000
+++ ubuntu/16.04/usr.bin.thunderbird	2016-04-25 20:13:29 +0000
@@ -168,6 +168,7 @@
   /usr/bin/mkfifo Uxr,  # investigate
   /bin/ps Uxr,
   /bin/uname Uxr,
+  /usr/bin/locale Uxr,
 
   /usr/bin/gpg Cx -> gpg,
 
@@ -221,6 +222,13 @@
     #include <abstractions/p11-kit>
     /usr/lib/gnupg2/gpg2keys_hkp ix,
 
+    # silence noise from enigmail 1.9+
+    deny owner @{HOME}/.thunderbird/*/.parentlock w,
+    deny owner @{HOME}/.thunderbird/*/panacea.dat w,
+    deny owner @{HOME}/.thunderbird/*/*.mab w,
+    deny owner @{HOME}/.thunderbird/**/*.msf w,
+    deny owner @{HOME}/.cache/thunderbird/**/_CACHE_* w,
+
     # For smartcards?
     /dev/bus/usb/ r,
     /dev/bus/usb/[0-9]*/ r,
@@ -246,11 +254,16 @@
     owner @{HOME}/.gnupg/.#lk0x[0-9a-f]* rwl,
     owner @{HOME}/.gnupg/.gpg-v[0-9]*-migrated rw,
     owner @{HOME}/** r,
+    owner @{PROC}/@{pids}/mountinfo r,
 
     # for inline pgp
     owner /tmp/encfile rw,
     owner /tmp/encfile-[0-9]* rw,
 
+    # for signature generation
+    owner /tmp/nsemail.eml w,
+    owner /tmp/nsemail-[0-9]*.eml w,
+
     # for signature verifications
     owner /tmp/data.sig r,
     owner /tmp/data-[0-9]*.sig r,