Skip to content

Thunderbird: drop the lsb_release special casing

Confining lsb_release strictly certainly did make some sense when this profile generally denied execution of random programs.

But we now allow Thunderbird to execute /{usr/local/,usr/,}bin/* under sanitized_helper, so special casing lsb_release does not make sense to me anymore: essentially we're treating lsb_release as more dangerous than the union of /{usr/local/,usr/,}bin/*. I don't think this is a reasonable risk assessment ⇒ let's instead treat lsb_release like any other helper program Thunderbird may need to run, e.g. to open attachments.

If a future risk analysis points out that lsb_release is indeed particularly dangerous (I'm not placing my bets on it, but who knows), and we want to revert this commit, then Philipp Kern's debugging report (https://bugs.debian.org/880953#10) should help understand the depth of this rabbit hole.

Fixes: https://bugs.debian.org/880953

Merge request reports