The goal is to make sure that, even if somebody is logged into the session, without knowing the password, he cannot access thunderbird saved mail. (on the other side, the hdd content is encrypted)
I thought that the simplest way would be to remove permission for .thunderbird from the user, so that launching thunderbird with access to the profile would require sudo, and similarly access to saved mail via the file manager would require sudo.
What would be the setup to do something like this? I.e., it requires to also ask for sudo when using chmod or any other means to modify permissions. Is it possible to make something like this work? (complicated setup is fine as long as usage stays simple)
Thanks for any help.