diff options
| author |   Jason Zaman <perfinion@gentoo.org> | 2021-02-20 21:18:52 -0800 |
|---|---|---|
| committer | Jason Zaman <perfinion@gentoo.org> | 2021-03-21 15:07:35 -0700 |
| commit | 2c0357f7e69e0d75c52933bd88771b17d0c39aa6 (patch) | |
| tree | 093895ee3ceb93e9d07bcf33eb64955bac870539 | |
| parent | dhcpc: read udev database (diff) | |
| download | hardened-refpolicy-2c0357f7.tar.gz hardened-refpolicy-2c0357f7.tar.bz2 hardened-refpolicy-2c0357f7.zip | |
bluetooth: Add bluetooth_socket perms
- Needs bluetooth/alg_socket access
- pulse needs shutdown perms on the socket
- also needs to read udev db
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/apps/pulseaudio.te | 1 | ||||
| -rw-r--r-- | policy/modules/services/bluetooth.if | 3 | ||||
| -rw-r--r-- | policy/modules/services/bluetooth.te | 6 |
3 files changed, 9 insertions, 1 deletions
diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te index fd2df71a..ceb954e4 100644 --- a/policy/modules/apps/pulseaudio.te +++ b/policy/modules/apps/pulseaudio.te @@ -54,6 +54,7 @@ allow pulseaudio_t self:process { getcap getsched setcap setrlimit setsched sign allow pulseaudio_t self:fifo_file rw_fifo_file_perms; allow pulseaudio_t self:unix_stream_socket { accept connectto listen }; allow pulseaudio_t self:unix_dgram_socket sendto; +allow pulseaudio_t self:bluetooth_socket shutdown; allow pulseaudio_t self:tcp_socket { accept listen }; allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms; diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if index e35e8631..3e4b0e5f 100644 --- a/policy/modules/services/bluetooth.if +++ b/policy/modules/services/bluetooth.if @@ -66,7 +66,8 @@ interface(`bluetooth_stream_connect',` ') files_search_runtime($1) - allow $1 bluetooth_t:socket rw_socket_perms; + allow $1 bluetooth_t:fd use; + allow $1 bluetooth_t:socket { rw_socket_perms shutdown }; stream_connect_pattern($1, bluetooth_runtime_t, bluetooth_runtime_t, bluetooth_t) ') diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index 69a38543..fcf0c177 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -60,6 +60,8 @@ allow bluetooth_t self:socket create_stream_socket_perms; allow bluetooth_t self:unix_stream_socket { accept connectto listen }; allow bluetooth_t self:tcp_socket { accept listen }; allow bluetooth_t self:netlink_kobject_uevent_socket create_socket_perms; +allow bluetooth_t self:bluetooth_socket server_stream_socket_perms; +allow bluetooth_t self:alg_socket create_stream_socket_perms; read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t) @@ -156,6 +158,10 @@ optional_policy(` ppp_domtrans(bluetooth_t) ') +optional_policy(` + udev_read_runtime_files(bluetooth_t) +') + ######################################## # # Helper local policy |