I would like to restrict an access to a directory. For example, on my system there is
~/.thunderbird directory that contains settings, letters, caches, etc of Thunderbird mail client. Obviously, other applications doesn't need the content of this folder. And other applications should not access the folder not because of security but just because of safety (for instance, "crazy" behavior of some other application caused by a bug or an error in my shell script should not affect the content of Thunderbird's directory).
I cannot use setuid bit on Thunderbird's executable (e.g.
/usr/bin/thunderbird). Because after setuid bit is set I will not access usual files created by Thunderbird (for example, downloaded attachments).
There is a workaround with setgid bit on Thunderbird's executable (downloaded attachments will has
thunderbird group while the owner will be me). But this way is not secure (because the owner will be me, so I can accidentally delete something from
Anyway, approach with setuid/setgid is unreliable and fragile (for example, after Thunderbird is removed and installed again the bits will be not present on the new instance of
chroot is not a solution because Thunderbird requires access not only to its home directory by to shared libraries as well.
I've also looked into AppArmor. Yes, I can set up restrictions on Thunderbird. But it seems impossible to write rule that denies an access to
~/.thunderbird for all executables except
Perhaps, the goal can be achieved via SELinux. But it's too complex to me for now. And it's superfluous: may be there is a simpler way.
Could you please help me and point to tool (or kernel module) that can allow an access to a directory for a certain application and deny an access for all the rest applications?
PS My distro is LinuxMint 17.1 32bit.