Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Received-SPF: Pass (protection.outlook.com: domain of moving-picture.com
 designates 193.203.95.25 as permitted sender)
 receiver=protection.outlook.com; client-ip=193.203.95.25;
 helo=email.moving-picture.com;
Subject: Re: Limiting what devices can pair over Bluetooth?
To:     Luiz Augusto von Dentz <luiz.dentz@gmail.com>
CC:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
References: <85C0B54E4752CA4F873E7C78CF0B26F5020662DB2C@LNDWSMBX02.ad.mpc.local>
 <CABBYNZ++9739ptHJm+tiUUJANN_MfRpurvfdD=a4Qw3OHE-Epg@mail.gmail.com>
From:   James Pearson <james-p@moving-picture.com>
Message-ID: <ac3d2402-abad-96dc-b042-8c8c7d592124@moving-picture.com>
Date:   Wed, 8 Jan 2020 20:15:03 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Firefox/52.0 SeaMonkey/2.49.5
MIME-Version: 1.0
In-Reply-To: <CABBYNZ++9739ptHJm+tiUUJANN_MfRpurvfdD=a4Qw3OHE-Epg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Jan 2020 20:15:29.2881
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: d31707ea-e8ab-4cd0-7df8-08d7947781dc
X-MS-Exchange-CrossTenant-Id: 036da35c-ba43-4e4a-9bff-72ec0f508621
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=036da35c-ba43-4e4a-9bff-72ec0f508621;Ip=[193.203.95.25];Helo=[email.moving-picture.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR0201MB3576
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Luiz Augusto von Dentz wrote:
> Hi James,
> 
> On Wed, Jan 8, 2020 at 3:47 AM James Pearson
> <james-p@moving-picture.com> wrote:
>> 
>> We don't normally enable Bluetooth on Linux (CentOS 7) installs for
>> security reasons, but we have a case where we would like to use a
>> Wacom tablet over Bluetooth
>> 
>> I would like to be able to configure things so Bluetooth can _only_
>> be used to pair with Wacom tablets (or just HID devices?)
>> 
>> As I never used Bluetooth in anger before, I'm struggling to find
>> out where to start looking - does anyone know how to do this - or
>> any pointers for where I should start looking?
> 
> Are you asking this from the system or user perspective, from the 
> system we don't have a configuration where you can restrict the
> types of devices that the user can pair, on the other hand there is
> nothing stopping the user interface (gnome, kde, etc) to implement
> such policy on their bluetooth settings, though be aware targeting a
> subset of HID devices may not be possible.

Ideally I would want to limit this at the system level - although I can 
not find anything user interface-wise that mentions limiting access 
either (although I might be looking in the wrong places?)

My aim is to prevent Bluetooth being used (in any way) to transfer 
files/data on/off the workstation

I've found that if I blacklist the bnep, cmtp and rfcomm kernel modules 
(just leaving the bluetooth and hidp kernel modules enabled) then the 
Wacom tablet still works over Bluetooth

Would this be sufficient to prevent any kind of file transfer over 
Bluetooth ?

Thanks

James Pearson