Received-SPF: pass (google.com: domain of linux-bluetooth+bounces-4868-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Precedence: bulk
MIME-Version: 1.0
References: <20240522064504.7560-1-quic_nakella@quicinc.com>
In-Reply-To: <20240522064504.7560-1-quic_nakella@quicinc.com>
From: Luiz Augusto von Dentz <luiz.dentz@gmail.com>
Date: Wed, 22 May 2024 14:43:54 -0400
Message-ID: <CABBYNZLX0PGEVEFhtWGiLdCN4gJTyg+mqSmRiq2y0sT--skjPQ@mail.gmail.com>
Subject: Re: [PATCH v3] Adding Sepolicy rules to allow bluetoothctl and
 dbus-daemon to access unix stream sockets.
To: Naga Bhavani Akella <quic_nakella@quicinc.com>
Cc: linux-bluetooth@vger.kernel.org, quic_mohamull@quicinc.com, 
	quic_hbandi@quicinc.com, quic_anubhavg@quicinc.com
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi Naga,

On Wed, May 22, 2024 at 2:46=E2=80=AFAM Naga Bhavani Akella
<quic_nakella@quicinc.com> wrote:
>
> Required for using acquire-notify, acquire-write options (Gatt Client)
> and Sending notifications (Gatt Server)
>
> Below are the avc denials that are fixed with this patch -
>
> 1. audit: type=3D1400 audit(1651238006.276:496):
> avc:  denied  { read write } for  pid=3D2165 comm=3D"bluetoothd"
> path=3D"socket:[43207]" dev=3D"sockfs" ino=3D43207
> scontext=3Dsystem_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tcontext=3Dsystem_u:system_r:initrc_t:s0-s15:c0.c1023
> tclass=3Dunix_stream_socket permissive=3D1
> 2. audit: type=3D1400 audit(1651238006.276:497):
> avc:  denied  { getattr } for  pid=3D2165 comm=3D"bluetoothd"
> path=3D"socket:[43207]" dev=3D"sockfs" ino=3D43207
> scontext=3Dsystem_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tcontext=3Dsystem_u:system_r:initrc_t:s0-s15:c0.c1023
> tclass=3Dunix_stream_socket permissive=3D1
> 3. audit: type=3D1400 audit(1651238006.272:495):
> avc:  denied  { read write } for  pid=3D689 comm=3D"dbus-daemon"
> path=3D"socket:[43207]" dev=3D"sockfs" ino=3D43207
> scontext=3Dsystem_u:system_r:system_dbusd_t:s0-s15:c0.c1023
> tcontext=3Dsystem_u:system_r:initrc_t:s0-s15:c0.c1023
> tclass=3Dunix_stream_socket permissive=3D1
> 4. audit: type=3D1400 audit(315966559.395:444):
> avc:  denied  { use } for  pid=3D710 comm=3D"dbus-daemon"
> path=3D"socket:[13196]" dev=3D"sockfs" ino=3D13196
> scontext=3Dsystem_u:system_r:system_dbusd_t:s0-s15:c0.c1023
> tcontext=3Dsystem_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tclass=3Dfd permissive=3D0
> 5. audit: type=3D1400 audit(315999854.939:523):
> avc:  denied  { read write } for  pid=3D812 comm=3D"dbus-daemon"
> path=3D"socket:[99469]" dev=3D"sockfs" ino=3D99469
> scontext=3Dsystem_u:system_r:system_dbusd_t:s0-s15:c0.c1023
> tcontext=3Dsystem_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tclass=3Dbluetooth_socket permissive=3D1
>
> Signed-off-by: Naga Bhavani Akella <quic_nakella@quicinc.com>
> ---
>  policy/modules/apps/pulseaudio.te    |  2 +-
>  policy/modules/services/bluetooth.if | 23 +++++++++++++++++++++++
>  policy/modules/services/dbus.te      |  2 +-
>  policy/modules/services/obex.te      |  2 +-
>  4 files changed, 26 insertions(+), 3 deletions(-)

Where is this coming from? I don't think we even have a policy folder,
and this might be an are where the distros want to have their own
policies so I'm not sure if we shall have this upstream, or perhaps
this is just for reference?

> diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/puls=
eaudio.te
> index 65b9a7428..42ed3a1d2 100644
> --- a/policy/modules/apps/pulseaudio.te
> +++ b/policy/modules/apps/pulseaudio.te
> @@ -193,7 +193,7 @@ optional_policy(`
>  ')
>
>  optional_policy(`
> -       bluetooth_stream_connect(pulseaudio_t)
> +       bluetooth_use(pulseaudio_t)
>  ')
>
>  optional_policy(`
> diff --git a/policy/modules/services/bluetooth.if b/policy/modules/servic=
es/bluetooth.if
> index c7e1c3f14..edead1fa1 100644
> --- a/policy/modules/services/bluetooth.if
> +++ b/policy/modules/services/bluetooth.if
> @@ -85,6 +85,29 @@ interface(`bluetooth_stream_connect',`
>         stream_connect_pattern($1, bluetooth_runtime_t, bluetooth_runtime=
_t, bluetooth_t)
>  ')
>
> +#####################################
> +## <summary>
> +##     Connect to bluetooth over a unix domain
> +##     stream socket.
> +## </summary>
> +## <param name=3D"domain">
> +##     <summary>
> +##     Domain allowed access.
> +##     </summary>
> +## </param>
> +#
> +interface(`bluetooth_use',`
> +       gen_require(`
> +               type bluetooth_t, bluetooth_runtime_t;
> +       ')
> +
> +       files_search_runtime($1)
> +       allow $1 bluetooth_t:bluetooth_socket rw_socket_perms;
> +       allow $1 bluetooth_t:unix_stream_socket { connectto rw_socket_per=
ms };
> +       allow $1 bluetooth_t:fd use;
> +       bluetooth_stream_connect($1);
> +')
> +
>  ########################################
>  ## <summary>
>  ##     Execute bluetooth in the bluetooth domain.
> diff --git a/policy/modules/services/dbus.te b/policy/modules/services/db=
us.te
> index 2d1d09d71..855ce86bd 100644
> --- a/policy/modules/services/dbus.te
> +++ b/policy/modules/services/dbus.te
> @@ -265,7 +265,7 @@ optional_policy(`
>  ')
>
>  optional_policy(`
> -       bluetooth_stream_connect(system_dbusd_t)
> +       bluetooth_use(system_dbusd_t)
>  ')
>
>  optional_policy(`
> diff --git a/policy/modules/services/obex.te b/policy/modules/services/ob=
ex.te
> index 6686edb37..5e2f20578 100644
> --- a/policy/modules/services/obex.te
> +++ b/policy/modules/services/obex.te
> @@ -31,7 +31,7 @@ miscfiles_read_localization(obex_t)
>  userdom_search_user_home_content(obex_t)
>
>  optional_policy(`
> -       bluetooth_stream_connect(obex_t)
> +       bluetooth_use(obex_t)
>  ')
>
>  optional_policy(`
> --
>


--=20
Luiz Augusto von Dentz