Received: by 2002:ab2:6d45:0:b0:1fb:d597:ff75 with SMTP id d5csp493085lqr; Wed, 5 Jun 2024 11:48:02 -0700 (PDT) X-Forwarded-Encrypted: i=3; AJvYcCWBYekjRaQP2k4BCk9X8xoFqF1yRcl1YaH0jzVCeB1Lb1Mv8EX41gi5JyKJBjIzM7kPELCRWOoJiPEABuWzKr7rKBNDTezPSaWNLlKIhw== X-Google-Smtp-Source: AGHT+IF9zxZ08uUBKB/Xucc8ULSSJLEiETmpCbKQkCfh+l/hTzY91WJZcpbKDdEVb3zY0wxsEvpC X-Received: by 2002:a05:6a00:b48:b0:702:3a47:2b1b with SMTP id d2e1a72fcca58-703e59bd19emr4043698b3a.20.1717613282027; Wed, 05 Jun 2024 11:48:02 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1717613282; cv=pass; d=google.com; s=arc-20160816; b=bufpCXZ9JA8vMpAynrxbOKTpmVezLWYDiUQLqRBhiDUgIm1NKaC5n7XrON6dr/UvSM N1KV3kJ2djnJ4uyf45jp081hsI25LyJt0posZF8vByaH2CQP8KuFdqKx3GCUNm0MZZlZ upYDMxgdXE8SsYO1OQkyaSHZ+kzIkFGiZw5HrLntdJsOpgraPd3exMsObqyC7diLBJCh d6GKgYZtZQzeQqCRnWSp0V3NWDCyxnpGF7jt/iC4ZA3bY/9iOb0NHntFK7WtzJldUmbS DXIGwAtATev8kdKlDaFdtyRxm1ljV37VgCabreN7+YLHG7FBO2Vt/06sPYevA4YRP+nn IK1g== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id:dkim-signature; bh=bPBsFy07oHbWWbJUOAtfqPV7HdZOQE/EW28KNibOQI0=; fh=wXwocMcsBBPwY1CZSFe4GN8pWLYpNdiYZ+qm83hHqeY=; b=Q7ZfioFFjP8ENhSGIuDwJsA/2PpSSBXtYdxhq6xXhCBHIqC1hzZmje5zUiMqHm5Spv RbshKDqJY3OAQzvScXJKSC4zOLKgjCp8llTJfDeRJOFEks160ex6bcQyA004aG0lUsW4 s95aKhLjxPah4gk0ppU5IHrQIDbA76CrJu1cZhgFHL/+GCvHM+1K+rmRdDt1f1/dkqqI B5qKKsW5qRrIn9fg1I8iuTSn9TZVdOwRau/812SpokR+NOcbsJ15vXtX3T8TPn3sa65a 706RHLtaipV9gR/kwchjGK06tZfxHer4EWWpe4sTUaU2xeEm7TC0EdWBTFOiSNAp0tBu xALA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; dkim=pass header.i=@ieee.org header.s=google header.b=cwQxRk2r; arc=pass (i=1 spf=pass spfdomain=ieee.org dkim=pass dkdomain=ieee.org dmarc=pass fromdomain=ieee.org); spf=pass (google.com: domain of selinux-refpolicy+bounces-29-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="selinux-refpolicy+bounces-29-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=ieee.org Return-Path: Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id 41be03b00d2f7-6ce545e953csi5928841a12.73.2024.06.05.11.48.01 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Jun 2024 11:48:02 -0700 (PDT) Received-SPF: pass (google.com: domain of selinux-refpolicy+bounces-29-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; dkim=pass header.i=@ieee.org header.s=google header.b=cwQxRk2r; arc=pass (i=1 spf=pass spfdomain=ieee.org dkim=pass dkdomain=ieee.org dmarc=pass fromdomain=ieee.org); spf=pass (google.com: domain of selinux-refpolicy+bounces-29-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="selinux-refpolicy+bounces-29-linux.lists.archive=gmail.com@vger.kernel.org"; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=ieee.org Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 3D9192823D1 for ; Wed, 5 Jun 2024 18:48:01 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id C30F12E634; Wed, 5 Jun 2024 18:47:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b="cwQxRk2r" X-Original-To: selinux-refpolicy@vger.kernel.org Received: from mail-oi1-f175.google.com (mail-oi1-f175.google.com [209.85.167.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0FB9A19D880 for ; Wed, 5 Jun 2024 18:47:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717613279; cv=none; b=OxHSfG0UMFQnLoq/jdVsaJSRNQgSONfgPR5vjMxqaCN/5gtQ+JML+7+fdkRa4OSBiVom0AvZLnJreuuqole+d4Wqzpb1MXCM4ILKM78Yq9XOis5ECxjYUVG+/2+QTS3BBRlexvxPjOuptnd6fKSQajcxbCOC6RVI64ahyWoMi0o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1717613279; c=relaxed/simple; bh=GYDeDyGOQw3xiQyWZS3gdkboxNzUwCC5H9d//z0qzgs=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=e89S70fNTJZ+41pgQNlCEDWQ4xTn2RM6R8iL/hQ5FvIFnrTA1D5y/z/KmsiEJC4NL1IzighZvx/i/LOW0JerclwfE9rBydcaXNvv9mpqX2QqwntdH27854qzDxHx9NRUFe7l/VNr+8znrlqcoypUwtzwpI6KIe21bNoEh1TFn28= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ieee.org; spf=pass smtp.mailfrom=ieee.org; dkim=pass (1024-bit key) header.d=ieee.org header.i=@ieee.org header.b=cwQxRk2r; arc=none smtp.client-ip=209.85.167.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=ieee.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ieee.org Received: by mail-oi1-f175.google.com with SMTP id 5614622812f47-3d201f9a55dso41007b6e.3 for ; Wed, 05 Jun 2024 11:47:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ieee.org; s=google; t=1717613276; x=1718218076; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=bPBsFy07oHbWWbJUOAtfqPV7HdZOQE/EW28KNibOQI0=; b=cwQxRk2ri2MbIaaIiY2ImYCTt/SG5bDVPcnZDYuG3U8Z8YK6ZDi8X5V9mh6MhHtTDy fkImEaNBWFMsDnjRAxvVWh+29NdxjMuDVRjW36rJr2enA8q4tlZl+HgsepUpuVs0tYVs m7/oHbEjqdp2m/ALGIS8rHIhngixh8o84zFUA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1717613276; x=1718218076; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=bPBsFy07oHbWWbJUOAtfqPV7HdZOQE/EW28KNibOQI0=; b=GrwB4fYcU4RicxRGjmqAzGFiW3xe5rlSBMwgE2KITkD4mDAVQl7TT2Yx1eDqeFDHG7 LUJvJyb/9L4+ZQurep2I2+uPg6FIj44ZBW+vBBcFlJFup5XAAUQooPkXQ2yCIm+wrV1r DNpJbmqFv52inXsCAiNtQ/Yz4togj6v6rE2d1FewtYa18bVsSTG7auKpyDLv95DOU0rY 3TEBtaq75uXhgkTMOBY/dfYCX3tPtwYAO2RkSxthWM6APoVdjnw4J74MCQXHhoUWnRIZ fwybN07srkQls2vap3WtHRHtJCI3EC5a4msDEb2l21ufZTfh1zysIhJ0yYrbo0NV0Qiq stTA== X-Forwarded-Encrypted: i=1; AJvYcCWCi8DKE1wSYnKKy2xEliXnBB0ryrJcYmNJPgbkOtzwCkel7nujrzWrx/B4kNJJSNm1mURRXFgfiVgMdemKse4Qe2nAcJfWOq9Y7FN/hJLUZrY= X-Gm-Message-State: AOJu0YzPVSW9EbBNS1Vii3tO/J//+3NLn7XsESbpMMTauPY8XXL9AgTV 3EoU8Xm+h1G1VAEximurnIIYlTvvtKQFg0/3OFSLqMgyHNrotTTKNV6KQI0DFw== X-Received: by 2002:aca:1306:0:b0:3d1:ddea:215f with SMTP id 5614622812f47-3d20425e236mr3591756b6e.7.1717613276107; Wed, 05 Jun 2024 11:47:56 -0700 (PDT) Received: from ?IPV6:2601:145:c200:2c70:ad6e:89a3:5e88:46d? ([2601:145:c200:2c70:ad6e:89a3:5e88:46d]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-6ae4a746322sm50143856d6.37.2024.06.05.11.47.55 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 05 Jun 2024 11:47:55 -0700 (PDT) Message-ID: <9aed08ac-9717-4d39-805b-8a9228668b29@ieee.org> Date: Wed, 5 Jun 2024 14:47:52 -0400 Precedence: bulk X-Mailing-List: selinux-refpolicy@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH v4] Adding Sepolicy rules to allow bluetoothctl and dbus-daemon to access unix stream sockets. To: Naga Bhavani Akella , selinux-refpolicy@vger.kernel.org Cc: quic_mohamull@quicinc.com, quic_hbandi@quicinc.com, quic_anubhavg@quicinc.com References: <20240527074945.24168-1-quic_nakella@quicinc.com> Content-Language: en-US From: Chris PeBenito In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 6/5/2024 2:38 AM, Naga Bhavani Akella wrote: > Hi Chris PeBenito, > > We have an add-on query regarding bluetoothctl context > > Based on your comment on patchset 2 >>> Yes, the point is that we probably need a bluetoothctl_t domain so the configuration can be done only via the bluetoothctl process, not just any initrc_t process. The existing bluetooth_helper_t domain may possibly be renamed/retrofitted for this purpose. > We tried adding bluetooth_helper_t domain for bluetoothctl using > "/usr/bin/bluetoothctl -- gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)" > but it was running in initrc_t context as shown when"ps -eZ | grep bluetoothctl" is run. > > Could you help us with this issue if it is already known. You would need to add: init_system_domain(bluetooth_helper_t, bluetooth_helper_exec_t) That, among other things, would allw the domain transition from initrc_t to bluetooth_helper_t when running bluetooth_helper_exec_t. -- Chris PeBenito