Launchpad has imported 9 comments from the remote bug at
https://bugzilla.redhat.com/show_bug.cgi?id=1602985.

If you reply to an imported comment from within Launchpad, your comment
will be sent to the remote bug automatically. Read more about
Launchpad's inter-bugtracker facilities at
https://help.launchpad.net/InterBugTracking.

------------------------------------------------------------------------
On 2018-07-19T00:34:47+00:00 Benjamin wrote:

Description of problem:

Bluetooth is always discoverable; when pairing a new device on my phone,
I noticed my laptop, but I did not have the GNOME Bluetooth settings
open at the time.

Version-Release number of selected component (if applicable):

3.28.0-1.fc28

How reproducible:

Always

Steps to Reproduce:
1. Boot up, log in
2. Scan for bluetooth devices with a separate computer

Actual results:

Machine name is displayed on phone

Expected results:

Machine name should not be displayed (should not be discoverable)

Additional info:

I can turn off discoverability from a term using bluetoothctl.

It seems that opening the Bluetooth settings will make the device
discoverable again, but does not make the device undiscoverable after
the settings are closed (this is not intended behavior; devices should
only be discoverable when the bluetooth settings UI is open).

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/0

------------------------------------------------------------------------
On 2018-07-19T10:29:26+00:00 Bastien wrote:

(In reply to Benjamin Kreuter from comment #0)
> It seems that opening the Bluetooth settings will make the device
> discoverable again, but does not make the device undiscoverable after the
> settings are closed (this is not intended behavior; devices should only be
> discoverable when the bluetooth settings UI is open).

It does turn it off. Except that bluetoothd and/or the kernel will fail
to make it undiscoverable.

Sender ":1.13387" is the Bluetooth settings. See how it requests for
"Discoverable" to be switched off, receives a response to the call
saying that Discoverable is now off, but receives a signal that
Discoverable changed back to "on" after a short time.

This is a dbus-monitor capture on exit:
method call time=1531995892.499232 sender=:1.13387 -> destination=:1.4 
serial=94 path=/org/bluez/hci0; interface=org.freedesktop.DBus.Properties; 
member=Set
   string "org.bluez.Adapter1"
   string "Discoverable"
   variant       boolean false
method call time=1531995892.499459 sender=:1.13387 -> destination=:1.4 
serial=95 path=/org/bluez/hci0; interface=org.freedesktop.DBus.Properties; 
member=Set
   string "org.bluez.Adapter1"
   string "DiscoverableTimeout"
   variant       uint32 0
method call time=1531995892.499485 sender=:1.13387 -> 
destination=org.freedesktop.DBus serial=96 path=/org/freedesktop/DBus; 
interface=org.freedesktop.DBus; member=RemoveMatch
   string "type='signal',sender=':1.4'"
method call time=1531995892.499556 sender=:1.13387 -> 
destination=org.freedesktop.DBus serial=97 path=/org/freedesktop/DBus; 
interface=org.freedesktop.DBus; member=RemoveMatch
   string 
"type='signal',sender='org.freedesktop.DBus',interface='org.freedesktop.DBus',member='NameOwnerChanged',path='/org/freedesktop/DBus',arg0='org.bluez'"
method return time=1531995892.499563 sender=org.freedesktop.DBus -> 
destination=:1.13387 serial=69 reply_serial=97
method call time=1531995892.499610 sender=:1.13387 -> 
destination=org.freedesktop.DBus serial=98 path=/org/freedesktop/DBus; 
interface=org.freedesktop.DBus; member=RemoveMatch
   string 
"type='signal',sender='org.bluez',interface='org.freedesktop.DBus.ObjectManager',path='/'"
method return time=1531995892.499616 sender=org.freedesktop.DBus -> 
destination=:1.13387 serial=70 reply_serial=98
method return time=1531995892.499665 sender=:1.4 -> destination=:1.13387 
serial=379 reply_serial=95
signal time=1531995892.523461 sender=:1.4 -> destination=(null destination) 
serial=380 path=/org/bluez/hci0; interface=org.freedesktop.DBus.Properties; 
member=PropertiesChanged
   string "org.bluez.Adapter1"
   array [
      dict entry(
         string "DiscoverableTimeout"
         variant             uint32 0
      )    
   ]
   array [
   ]
method return time=1531995892.523489 sender=:1.4 -> destination=:1.13387 
serial=381 reply_serial=94
signal time=1531995892.533281 sender=:1.4 -> destination=(null destination) 
serial=382 path=/org/bluez/hci0; interface=org.freedesktop.DBus.Properties; 
member=PropertiesChanged
   string "org.bluez.Adapter1"
   array [
      dict entry(
         string "Discoverable"
         variant             boolean false
      )    
   ]
   array [
   ]
signal time=1531995892.551915 sender=:1.4 -> destination=(null destination) 
serial=383 path=/org/bluez/hci0; interface=org.freedesktop.DBus.Properties; 
member=PropertiesChanged
   string "org.bluez.Adapter1"
   array [
      dict entry(
         string "Discoverable"
         variant             boolean true 
      )    
   ]
   array [
   ]

This corresponds with this warning in my journal:
Jul 19 12:28:20 classic kernel: Bluetooth: hci0: last event is not cmd complete 
(0x0f)

Let's start reassigning this to bluez to start with, as that's where
we'll need to dig.

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/1

------------------------------------------------------------------------
On 2018-07-19T11:07:43+00:00 Bastien wrote:

Making this call, without waiting for the reply, always fails:
dbus-send  --system --dest=org.bluez /org/bluez/hci0 
org.freedesktop.DBus.Properties.Set string:org.bluez.Adapter1 
string:Discoverable variant:boolean:false ; dbus-send  --system 
--dest=org.bluez /org/bluez/hci0 org.freedesktop.DBus.Properties.Set 
string:org.bluez.Adapter1 string:DiscoverableTimeout variant:uint32:0

The same call with the --print-reply argument to dbus-send will however
work. I think bluez might be ignoring the calls if the caller is going
to disappear.

I monitored the state of "Discoverable" and "DiscoverableTimeout" using
bluetoothctl, after setting Discoverable to on.

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/2

------------------------------------------------------------------------
On 2018-07-19T11:34:46+00:00 Bastien wrote:

The D-Bus end-points for those 2 properties are:
property_set_discoverable and property_set_discoverable_timeout
in src/adapter.c

bluetoothd, to change those properties, calls out asynchronously to the kernel:
property_set_mode -> async stuff -> property_set_mode_complete -> 
new_settings_callback() sets adapter->current_settings

And to those used to async programming, the problem should be obvious. In 
property_set_discoverable_timeout():
        if (adapter->current_settings & MGMT_SETTING_DISCOVERABLE)
                set_discoverable(adapter, 0x01, adapter->discoverable_timeout);

So if a discoverable setting is pending, adapter->current_settings isn't
set to the new value, and discoverable is *reset* to on.

This is a definite bug in bluez, though work-aroundable in gnome-
bluetooth.

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/3

------------------------------------------------------------------------
On 2018-07-19T12:26:27+00:00 Bastien wrote:

Worked-around in gnome-bluetooth 3.28:
https://gitlab.gnome.org/GNOME/gnome-bluetooth/commit/6b5086d42ea64d46277f3c93b43984f331d12f89

The problem would not occur in 3.26 as D-Bus calls were synchronous, and we 
would DiscoverableTimeout if Discoverable was set:
https://gitlab.gnome.org/GNOME/gnome-bluetooth/blob/gnome-3-26/lib/bluetooth-client.c#L1118

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/4

------------------------------------------------------------------------
On 2018-07-19T12:45:33+00:00 Bastien wrote:

(In reply to Bastien Nocera from comment #4)
> The problem would not occur in 3.26 as D-Bus calls were synchronous, and we
> would DiscoverableTimeout if Discoverable was set:

we would "not set" DiscoverableTimeout if...

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/5

------------------------------------------------------------------------
On 2018-07-25T11:08:21+00:00 Bastien wrote:

Upstream patches to avoid the race mentioned earlier:
https://marc.info/?l=linux-bluetooth&m=153251404332012&w=2
https://marc.info/?l=linux-bluetooth&m=153251404332014&w=2
https://marc.info/?l=linux-bluetooth&m=153251404332015&w=2
https://marc.info/?l=linux-bluetooth&m=153251404532016&w=2

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/6

------------------------------------------------------------------------
On 2018-07-27T12:23:09+00:00 Bastien wrote:

And this set:
https://marc.info/?l=linux-bluetooth&m=153261464929156&w=2
https://marc.info/?l=linux-bluetooth&m=153261465129157&w=2
https://marc.info/?l=linux-bluetooth&m=153261465229159&w=2
https://marc.info/?l=linux-bluetooth&m=153261465329160&w=2
https://marc.info/?l=linux-bluetooth&m=153261465529161&w=2
when used, should completely avoid the Discoverable state being on when the 
Settings are closed.

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/7

------------------------------------------------------------------------
On 2018-07-27T14:18:54+00:00 Bastien wrote:

(In reply to Bastien Nocera from comment #7)
> And this set:
> https://marc.info/?l=linux-bluetooth&m=153261464929156&w=2
> https://marc.info/?l=linux-bluetooth&m=153261465129157&w=2
> https://marc.info/?l=linux-bluetooth&m=153261465229159&w=2
> https://marc.info/?l=linux-bluetooth&m=153261465329160&w=2
> https://marc.info/?l=linux-bluetooth&m=153261465529161&w=2
> when used, should completely avoid the Discoverable state being on when the
> Settings are closed.

The gnome-bluetooth patches to use this new functionality, when available:
https://gitlab.gnome.org/GNOME/gnome-bluetooth/merge_requests/1

Reply at: https://bugs.launchpad.net/ubuntu/+source/gnome-
bluetooth/+bug/1791405/comments/8


** Changed in: gnome-bluetooth (Fedora)
       Status: Unknown => Confirmed

** Changed in: gnome-bluetooth (Fedora)
   Importance: Unknown => Undecided

-- 
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to gnome-bluetooth in Ubuntu.
https://bugs.launchpad.net/bugs/1791405

Title:
  bluetooth always in discoverable mode (security issue)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gnome-bluetooth/+bug/1791405/+subscriptions

-- 
desktop-bugs mailing list
desktop-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs

Reply via email to