[PATCH v1] sepolicy: Add sepolicy rules for hcidump, hciconfig, hcitool and l2test failures

Fix to resolve below avc denials -

AVC avc:  denied  { ioctl } for  pid=1884 comm="hciconfig" path="socket:[23486]" dev="sockfs"
ino=23486 ioctlcmd=0x48d2 scontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
tcontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=bluetooth_socket
permissive=0

AVC avc:  denied  { net_raw } for  pid=1917 comm="hcidump" capability=13
scontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
tcontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=capability
permissive=0

AVC avc:  denied  { write } for  pid=1905 comm="hcitool" path="socket:[28744]" dev="sockfs"
ino=28744 scontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
tcontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=bluetooth_socket
permissive=0

AVC avc:  denied  { listen } for  pid=8149 comm="l2test"
scontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
tcontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=bluetooth_socket
permissive=0

AVC avc:  denied  { accept } for  pid=1959 comm="l2test"
scontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
tcontext=root:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=bluetooth_socket
permissive=0

---
 policy/modules/services/bluetooth.fc | 4 ++++
 policy/modules/services/bluetooth.te | 8 ++++++++
 2 files changed, 12 insertions(+)

diff --git a/policy/modules/services/bluetooth.fc b/policy/modules/services/bluetooth.fc
index 6067df4b8..fdccb0b17 100644
--- a/policy/modules/services/bluetooth.fc
+++ b/policy/modules/services/bluetooth.fc
@@ -8,6 +8,10 @@
 /usr/bin/blue.*pin	--	gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
 /usr/bin/bluetoothd	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
 /usr/bin/bluetoothctl	--	gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
+/usr/bin/hciconfig  --  gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
+/usr/bin/hcidump  --  gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
+/usr/bin/hcitool  --  gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
+/usr/bin/l2test   --  gen_context(system_u:object_r:bluetooth_helper_exec_t,s0)
 /usr/bin/dund	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
 /usr/bin/hciattach	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
 /usr/bin/hcid	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index 196922240..f40a16040 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -182,6 +182,14 @@ allow bluetooth_helper_t bluetooth_t:socket { read write };
 allow bluetooth_helper_t bluetooth_t:fd use;
 allow bluetooth_helper_t bluetooth_t:unix_stream_socket rw_socket_perms;
 
+allow bluetooth_helper_t self:capability { net_admin net_raw };
+allow bluetooth_helper_t self:bluetooth_socket { getattr getopt bind create setopt read };
+getty_use_fds(bluetooth_helper_t)
+ssh_use_sshd_pidfds(bluetooth_helper_t)
+userdom_use_user_ptys(bluetooth_helper_t)
+userdom_use_user_ttys(bluetooth_helper_t)
+allow bluetooth_helper_t self:bluetooth_socket { ioctl write listen accept connect };
+
 manage_dirs_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
 manage_files_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
 manage_sock_files_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
-- 
2.34.1