From: Yun-Hao Chung <[email protected]>
Hi manintainers,
This series is to
1. Implement a few methods in core so that a plugin can have control of
allowing / disallowing certain service connections.
2. Implement the AdminPolicy plugin. The plugin provides interfaces
AdminPolicySet and AdminPolicyStatus. For each policy, users should
set the value thorugh AdminPolicySet and query the current setting
through AdminPolicyStatus. We separeted these two interfaces so that
developers can assign different groups of users to these interfaces.
Currently the only policy is ServiceAllowList, which make bluez only
allow a list of service by specified their UUIDs, but the plugin is
also expected to provide more controls over other bluez behaviors.
Since the second part is a plugin, it might not be necessary to land in
upstream tree.
Thanks.
Changes in v6:
- include <errno.h> instead of <error.h> in plugins/admin.c
Changes in v5:
- Fix compiler errors in plugins/admin.c
Changes in v4:
- Update commit message (admin_policy -> admin)
- remove old plugins/admin_policy.c
Changes in v3:
- Rename plugins/admin_policy.c -> plugins/admin.c
- Use device_added callback in btd_adapter_driver instead of listen for
dbus
- Add authorization method in profiles/health/mcap.c and block incoming
connections in adapter authorization function.
Changes in v2:
- Move bt_uuid_hash and bt_uuid_equal functions to adapter.c.
- Modify the criteria to say a device is `Affected` from any-of-uuid
to any-of-auto-connect-profile.
- Remove the code to remove/reprobe disallowed/allowed profiles,
instead, check if the service is allowed in bt_io_accept connect_cb.
- Fix a typo in emit_property_change in
plugin/admin_policy.c:set_service_allowlist
- Instead of using device_state_cb, utilize D-BUS client to watch device
added/removed.
- Add a document in doc/
Yun-Hao Chung (13):
core: add is_allowed property in btd_service
core: add adapter and device allowed_uuid functions
mcap: add adapter authorization
core: block not allowed UUID connect in auth
core: add device_added and device_removed to adapter driver
plugins: new plugin
plugins/admin: add admin_policy adapter driver
plugins/admin: add ServiceAllowList method
plugins/admin: add ServiceAllowList property
plugins/admin: add device callbacks
plugins/admin: add AffectedByPolicy property
plugins/admin: persist policy settings
doc: add description of admin policy
Makefile.plugins | 5 +
android/health.c | 2 +-
bootstrap-configure | 1 +
configure.ac | 4 +
doc/admin-policy-api.txt | 65 +++++
plugins/admin.c | 592 +++++++++++++++++++++++++++++++++++++++
profiles/health/hdp.c | 1 +
profiles/health/mcap.c | 39 ++-
profiles/health/mcap.h | 7 +
src/adapter.c | 154 +++++++++-
src/adapter.h | 12 +
src/device.c | 64 ++++-
src/device.h | 2 +
src/profile.c | 11 +
src/service.c | 39 +++
src/service.h | 2 +
tools/mcaptest.c | 2 +-
17 files changed, 992 insertions(+), 10 deletions(-)
create mode 100644 doc/admin-policy-api.txt
create mode 100644 plugins/admin.c
--
2.32.0.554.ge1b32706d8-goog
From: Yun-Hao Chung <[email protected]>
This adds admin-policy-api.txt.
Reviewed-by: Miao-chen Chou <[email protected]>
---
(no changes since v1)
doc/admin-policy-api.txt | 65 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 65 insertions(+)
create mode 100644 doc/admin-policy-api.txt
diff --git a/doc/admin-policy-api.txt b/doc/admin-policy-api.txt
new file mode 100644
index 000000000000..3f116901dbd7
--- /dev/null
+++ b/doc/admin-policy-api.txt
@@ -0,0 +1,65 @@
+BlueZ D-Bus Admin Policy API description
+***********************************
+
+This API provides methods to control the behavior of bluez as an administrator.
+
+Interface AdminPolicySet1 provides methods to set policies. Once the policy is
+set successfully, it will affect all clients and stay persistently even after
+restarting Bluetooth Daemon. The only way to clear it is to overwrite the
+policy with the same method.
+
+Interface AdminPolicyStatus1 provides readonly properties to indicate the
+current values of admin policy.
+
+
+Admin Policy Set hierarchy
+=================
+
+Service org.bluez
+Interface org.bluez.AdminPolicySet1
+Object path [variable prefix]/{hci0,hci1,...}
+
+Methods void SetServiceAllowList(array{string} UUIDs)
+
+ This method sets the service allowlist by specifying
+ service UUIDs.
+
+ When SetServiceAllowList is called, bluez will block
+ incoming and outgoing connections to the service not in
+ UUIDs for all of the clients.
+
+ Any subsequent calls to this method will supersede any
+ previously set allowlist values. Calling this method
+ with an empty array will allow any service UUIDs to be
+ used.
+
+ The default value is an empty array.
+
+ Possible errors: org.bluez.Error.InvalidArguments
+ org.bluez.Error.Failed
+
+
+Admin Policy Status hierarchy
+=================
+
+Service org.bluez
+Interface org.bluez.AdminPolicyStatus1
+Object path [variable prefix]/{hci0,hci1,...}
+
+Properties array{string} ServiceAllowList [readonly]
+
+ Current value of service allow list.
+
+
+
+Admin Policy Status hierarchy
+=================
+
+Service org.bluez
+Interface org.bluez.AdminPolicyStatus1
+Object path [variable prefix]/{hci0,hci1,...}/dev_XX_XX_XX_XX_XX_XX
+
+Properties bool IsAffectedByPolicy [readonly]
+
+ Indicate if there is any auto-connect profile in this
+ device is not allowed by admin policy.
--
2.32.0.554.ge1b32706d8-goog