We don't normally enable Bluetooth on Linux (CentOS 7) installs for security reasons, but we have a case where we would like to use a Wacom tablet over Bluetooth
I would like to be able to configure things so Bluetooth can _only_ be used to pair with Wacom tablets (or just HID devices?)
As I never used Bluetooth in anger before, I'm struggling to find out where to start looking - does anyone know how to do this - or any pointers for where I should start looking?
Thanks
James Pearson
Hi James,
On Wed, Jan 8, 2020 at 3:47 AM James Pearson <[email protected]> wrote:
>
> We don't normally enable Bluetooth on Linux (CentOS 7) installs for security reasons, but we have a case where we would like to use a Wacom tablet over Bluetooth
>
> I would like to be able to configure things so Bluetooth can _only_ be used to pair with Wacom tablets (or just HID devices?)
>
> As I never used Bluetooth in anger before, I'm struggling to find out where to start looking - does anyone know how to do this - or any pointers for where I should start looking?
Are you asking this from the system or user perspective, from the
system we don't have a configuration where you can restrict the types
of devices that the user can pair, on the other hand there is nothing
stopping the user interface (gnome, kde, etc) to implement such policy
on their bluetooth settings, though be aware targeting a subset of HID
devices may not be possible.
--
Luiz Augusto von Dentz
Luiz Augusto von Dentz wrote:
> Hi James,
>
> On Wed, Jan 8, 2020 at 3:47 AM James Pearson
> <[email protected]> wrote:
>>
>> We don't normally enable Bluetooth on Linux (CentOS 7) installs for
>> security reasons, but we have a case where we would like to use a
>> Wacom tablet over Bluetooth
>>
>> I would like to be able to configure things so Bluetooth can _only_
>> be used to pair with Wacom tablets (or just HID devices?)
>>
>> As I never used Bluetooth in anger before, I'm struggling to find
>> out where to start looking - does anyone know how to do this - or
>> any pointers for where I should start looking?
>
> Are you asking this from the system or user perspective, from the
> system we don't have a configuration where you can restrict the
> types of devices that the user can pair, on the other hand there is
> nothing stopping the user interface (gnome, kde, etc) to implement
> such policy on their bluetooth settings, though be aware targeting a
> subset of HID devices may not be possible.
Ideally I would want to limit this at the system level - although I can
not find anything user interface-wise that mentions limiting access
either (although I might be looking in the wrong places?)
My aim is to prevent Bluetooth being used (in any way) to transfer
files/data on/off the workstation
I've found that if I blacklist the bnep, cmtp and rfcomm kernel modules
(just leaving the bluetooth and hidp kernel modules enabled) then the
Wacom tablet still works over Bluetooth
Would this be sufficient to prevent any kind of file transfer over
Bluetooth ?
Thanks
James Pearson
Hi James,
On Wed, Jan 8, 2020 at 12:15 PM James Pearson
<[email protected]> wrote:
>
> Luiz Augusto von Dentz wrote:
> > Hi James,
> >
> > On Wed, Jan 8, 2020 at 3:47 AM James Pearson
> > <[email protected]> wrote:
> >>
> >> We don't normally enable Bluetooth on Linux (CentOS 7) installs for
> >> security reasons, but we have a case where we would like to use a
> >> Wacom tablet over Bluetooth
> >>
> >> I would like to be able to configure things so Bluetooth can _only_
> >> be used to pair with Wacom tablets (or just HID devices?)
> >>
> >> As I never used Bluetooth in anger before, I'm struggling to find
> >> out where to start looking - does anyone know how to do this - or
> >> any pointers for where I should start looking?
> >
> > Are you asking this from the system or user perspective, from the
> > system we don't have a configuration where you can restrict the
> > types of devices that the user can pair, on the other hand there is
> > nothing stopping the user interface (gnome, kde, etc) to implement
> > such policy on their bluetooth settings, though be aware targeting a
> > subset of HID devices may not be possible.
>
> Ideally I would want to limit this at the system level - although I can
> not find anything user interface-wise that mentions limiting access
> either (although I might be looking in the wrong places?)
>
> My aim is to prevent Bluetooth being used (in any way) to transfer
> files/data on/off the workstation
>
> I've found that if I blacklist the bnep, cmtp and rfcomm kernel modules
> (just leaving the bluetooth and hidp kernel modules enabled) then the
> Wacom tablet still works over Bluetooth
bnep is for tethering, depending on the system that might be useful,
and if you block RFCOMM you no only block usage of file transfer but
also HFP, but perhaps you don't care about those so that would be fine
to disable. Btw, for getting file sharing you would just need to
disable obexd though it doesn't seems it is a user service which you
can disable with systemctl.
> Would this be sufficient to prevent any kind of file transfer over
> Bluetooth ?
>
> Thanks
>
> James Pearson
--
Luiz Augusto von Dentz
Luiz Augusto von Dentz wrote:
>
>> My aim is to prevent Bluetooth being used (in any way) to transfer
>> files/data on/off the workstation
>>
>> I've found that if I blacklist the bnep, cmtp and rfcomm kernel modules
>> (just leaving the bluetooth and hidp kernel modules enabled) then the
>> Wacom tablet still works over Bluetooth
>
> bnep is for tethering, depending on the system that might be useful,
> and if you block RFCOMM you no only block usage of file transfer but
> also HFP, but perhaps you don't care about those so that would be fine
> to disable. Btw, for getting file sharing you would just need to
> disable obexd though it doesn't seems it is a user service which you
> can disable with systemctl.
>
>> Would this be sufficient to prevent any kind of file transfer over
>> Bluetooth ?
Looks like with these kernel modules disabled, I can still use
'bluetooth-send' to send a file to a paired (Android) phone ... removing
the OS provided obexd binary prevents bluetooth-send from running, but
it doesn't stop a user running their own copy of obexd
So it looks like, in our case, we won't be able to use a Wacom tablet
over Bluetooth - without opening up a whole can of worms ... which is a
shame
Thanks
James Pearson