Received-SPF: pass (google.com: best guess record for domain of linux-bluetooth-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Received-SPF: Pass (protection.outlook.com: domain of moving-picture.com
 designates 193.203.95.25 as permitted sender)
 receiver=protection.outlook.com; client-ip=193.203.95.25;
 helo=email.moving-picture.com;
Subject: Re: Limiting what devices can pair over Bluetooth?
To:     Luiz Augusto von Dentz <luiz.dentz@gmail.com>
CC:     "linux-bluetooth@vger.kernel.org" <linux-bluetooth@vger.kernel.org>
References: <85C0B54E4752CA4F873E7C78CF0B26F5020662DB2C@LNDWSMBX02.ad.mpc.local>
 <CABBYNZ++9739ptHJm+tiUUJANN_MfRpurvfdD=a4Qw3OHE-Epg@mail.gmail.com>
 <ac3d2402-abad-96dc-b042-8c8c7d592124@moving-picture.com>
 <CABBYNZKAkZLvce-MfpscV6Y=9+UBVXAdcVgKAWTH8HupW8_qVA@mail.gmail.com>
From:   James Pearson <james-p@moving-picture.com>
Message-ID: <10177aaf-cc9a-d807-9265-58bbb69c8386@moving-picture.com>
Date:   Thu, 9 Jan 2020 14:53:42 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Firefox/52.0 SeaMonkey/2.49.5
MIME-Version: 1.0
In-Reply-To: <CABBYNZKAkZLvce-MfpscV6Y=9+UBVXAdcVgKAWTH8HupW8_qVA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Jan 2020 14:53:48.0655
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 4d1d61f5-add8-45e1-3470-08d79513bbd4
X-MS-Exchange-CrossTenant-Id: 036da35c-ba43-4e4a-9bff-72ec0f508621
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=036da35c-ba43-4e4a-9bff-72ec0f508621;Ip=[193.203.95.25];Helo=[email.moving-picture.com]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM5PR02MB2363
Sender: linux-bluetooth-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-bluetooth.vger.kernel.org>
X-Mailing-List: linux-bluetooth@vger.kernel.org

Luiz Augusto von Dentz wrote:
> 
>> My aim is to prevent Bluetooth being used (in any way) to transfer
>> files/data on/off the workstation
>>
>> I've found that if I blacklist the bnep, cmtp and rfcomm kernel modules
>> (just leaving the bluetooth and hidp kernel modules enabled) then the
>> Wacom tablet still works over Bluetooth
> 
> bnep is for tethering, depending on the system that might be useful,
> and if you block RFCOMM you no only block usage of file transfer but
> also HFP, but perhaps you don't care about those so that would be fine
> to disable. Btw, for getting file sharing you would just need to
> disable obexd though it doesn't seems it is a user service which you
> can disable with systemctl.
> 
>> Would this be sufficient to prevent any kind of file transfer over
>> Bluetooth ?

Looks like with these kernel modules disabled, I can still use 
'bluetooth-send' to send a file to a paired (Android) phone ... removing 
the OS provided obexd binary prevents bluetooth-send from running, but 
it doesn't stop a user running their own copy of obexd

So it looks like, in our case, we won't be able to use a Wacom tablet 
over Bluetooth - without opening up a whole can of worms ... which is a 
shame

Thanks

James Pearson