commit: 2c0357f7e69e0d75c52933bd88771b17d0c39aa6 Author: Jason Zaman <perfinion <AT> gentoo <DOT> org> AuthorDate: Sun Feb 21 05:18:52 2021 +0000 Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> CommitDate: Sun Mar 21 22:07:35 2021 +0000 URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=2c0357f7
bluetooth: Add bluetooth_socket perms - Needs bluetooth/alg_socket access - pulse needs shutdown perms on the socket - also needs to read udev db Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> policy/modules/apps/pulseaudio.te | 1 + policy/modules/services/bluetooth.if | 3 ++- policy/modules/services/bluetooth.te | 6 ++++++ 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/policy/modules/apps/pulseaudio.te b/policy/modules/apps/pulseaudio.te index fd2df71a..ceb954e4 100644 --- a/policy/modules/apps/pulseaudio.te +++ b/policy/modules/apps/pulseaudio.te @@ -54,6 +54,7 @@ allow pulseaudio_t self:process { getcap getsched setcap setrlimit setsched sign allow pulseaudio_t self:fifo_file rw_fifo_file_perms; allow pulseaudio_t self:unix_stream_socket { accept connectto listen }; allow pulseaudio_t self:unix_dgram_socket sendto; +allow pulseaudio_t self:bluetooth_socket shutdown; allow pulseaudio_t self:tcp_socket { accept listen }; allow pulseaudio_t self:netlink_kobject_uevent_socket create_socket_perms; diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if index e35e8631..3e4b0e5f 100644 --- a/policy/modules/services/bluetooth.if +++ b/policy/modules/services/bluetooth.if @@ -66,7 +66,8 @@ interface(`bluetooth_stream_connect',` ') files_search_runtime($1) - allow $1 bluetooth_t:socket rw_socket_perms; + allow $1 bluetooth_t:fd use; + allow $1 bluetooth_t:socket { rw_socket_perms shutdown }; stream_connect_pattern($1, bluetooth_runtime_t, bluetooth_runtime_t, bluetooth_t) ') diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te index 69a38543..fcf0c177 100644 --- a/policy/modules/services/bluetooth.te +++ b/policy/modules/services/bluetooth.te @@ -60,6 +60,8 @@ allow bluetooth_t self:socket create_stream_socket_perms; allow bluetooth_t self:unix_stream_socket { accept connectto listen }; allow bluetooth_t self:tcp_socket { accept listen }; allow bluetooth_t self:netlink_kobject_uevent_socket create_socket_perms; +allow bluetooth_t self:bluetooth_socket server_stream_socket_perms; +allow bluetooth_t self:alg_socket create_stream_socket_perms; read_files_pattern(bluetooth_t, bluetooth_conf_t, bluetooth_conf_t) @@ -156,6 +158,10 @@ optional_policy(` ppp_domtrans(bluetooth_t) ') +optional_policy(` + udev_read_runtime_files(bluetooth_t) +') + ######################################## # # Helper local policy