Re: [PATCH v1] Adding SE Policy rules to allow usage of unix stream sockets by dbus and bluetooth contexts when Gatt notifications are turned on by remote.

[Chris PeBenito <pebenito@xxxxxxxx>]

On 8/6/2024 6:06 AM, Naga Bhavani Akella wrote:
> Below are the avc denials that are resolved -
>
> 1. AVC avc:  denied  { use } for  pid=916 comm="dbus-daemon"
> path="socket:[71126]" dev="sockfs" ino=71126
> scontext=system_u:system_r:system_dbusd_t:s0-s15:c0.c1023
> tcontext=system_u:system_r:bluetooth_helper_t:s0-s15:c0.c1023
> tclass=fd permissive=0
>
> 2. AVC avc:  denied  { read write } for  pid=913 comm="dbus-daemon"
> path="socket:[25037]" dev="sockfs" ino=25037
> scontext=system_u:system_r:system_dbusd_t:s0-s15:c0.c1023
> tcontext=system_u:system_r:bluetooth_helper_t:s0-s15:c0.c1023
> tclass=unix_stream_socket permissive=0
>
> 3. AVC avc:  denied  { use } for  pid=910 comm="bluetoothd"
> path="socket:[23966]" dev="sockfs" ino=23966
> scontext=system_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tcontext=system_u:system_r:bluetooth_helper_t:s0-s15:c0.c1023
> tclass=fd permissive=0
>
> 4. AVC avc:  denied  { read write } for  pid=2229 comm="bluetoothd"
> path="socket:[27264]" dev="sockfs" ino=27264
> scontext=system_u:system_r:bluetooth_t:s0-s15:c0.c1023
> tcontext=system_u:system_r:bluetooth_helper_t:s0-s15:c0.c1023
> tclass=unix_stream_socket permissive=0
>
> Signed-off-by: Naga Bhavani Akella <quic_nakella@xxxxxxxxxxx>
> ---
>   policy/modules/services/bluetooth.if | 23 +++++++++++++++++++++++
>   policy/modules/services/bluetooth.te |  4 ++++
>   policy/modules/services/dbus.te      |  1 +
>   3 files changed, 28 insertions(+)
>
> diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if
> index bd3dff2ff..1c1526ad1 100644
> --- a/policy/modules/services/bluetooth.if
> +++ b/policy/modules/services/bluetooth.if
> @@ -187,6 +187,29 @@ interface(`bluetooth_dontaudit_read_helper_state',`
>   	dontaudit $1 bluetooth_helper_t:file read_file_perms;
>   ')
>   
> +#####################################
> +## <summary>
> +##	Connect to bluetooth over a unix domain
> +##	stream socket. The socket can be used
> +##      for read and write. This is required for
> +#       bluetooth helper context.
> +## </summary>
> +## <param name="domain">
> +##	<summary>
> +##	Domain allowed access.
> +##	</summary>
> +## </param>
> +#
> +interface(`bluetooth_helper_use',`

Please rename to "bluetooth_use_inherited_helper_stream_sockets".


> +	gen_require(`
> +		type bluetooth_helper_t;
> +	')
> +
> +	files_search_runtime($1)

There are no files involved so this is not necessary.



> +	allow $1 bluetooth_helper_t:unix_stream_socket rw_socket_perms;
> +	allow $1 bluetooth_helper_t:fd use;
> +')
> +
>   ########################################
>   ## <summary>
>   ##	All of the rules required to
> diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
> index 534f1b36d..d008252d1 100644
> --- a/policy/modules/services/bluetooth.te
> +++ b/policy/modules/services/bluetooth.te
> @@ -76,6 +76,10 @@ filetrans_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_rw_t, { dir file
>   allow bluetooth_t bluetooth_lock_t:file manage_file_perms;
>   files_lock_filetrans(bluetooth_t, bluetooth_lock_t, file)
>   
> +optional_policy(`
> +	bluetooth_helper_use(bluetooth_t)
> +')

This is part of the bluetooth module, so it need not be optional.


--
Chris PeBenito