Re: [PATCH v1] sepolicy: Add sepolicy rules for hcidump, hciconfig, hcitool and l2test failures

On Wednesday, January 7, 2026 5:08:38=E2=80=AFAM Eastern Standard Time Amis=
ha Jain wrote:
> Fix to resolve below avc denials -
>=20
> AVC avc:  denied  { ioctl } for  pid=3D1884 comm=3D"hciconfig" path=3D"so=
cket:[23486]" dev=3D"sockfs"
> ino=3D23486 ioctlcmd=3D0x48d2 scontext=3Droot:sysadm_r:bluetooth_helper_t=
:s0-s0:c0.c1023
> tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=3Dbluet=
ooth_socket
> permissive=3D0
>=20
> AVC avc:  denied  { net_raw } for  pid=3D1917 comm=3D"hcidump" capability=
=3D13
> scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=3Dcapab=
ility
> permissive=3D0

You added net_admin too. Is that from hcidump too?


> AVC avc:  denied  { write } for  pid=3D1905 comm=3D"hcitool" path=3D"sock=
et:[28744]" dev=3D"sockfs"
> ino=3D28744 scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=3Dbluet=
ooth_socket
> permissive=3D0
>=20
> AVC avc:  denied  { listen } for  pid=3D8149 comm=3D"l2test"
> scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=3Dbluet=
ooth_socket
> permissive=3D0
>=20
> AVC avc:  denied  { accept } for  pid=3D1959 comm=3D"l2test"
> scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023 tclass=3Dbluet=
ooth_socket
> permissive=3D0
>=20
> ---
>  policy/modules/services/bluetooth.fc | 4 ++++
>  policy/modules/services/bluetooth.te | 8 ++++++++
>  2 files changed, 12 insertions(+)
>=20
> diff --git a/policy/modules/services/bluetooth.fc b/policy/modules/servic=
es/bluetooth.fc
> index 6067df4b8..fdccb0b17 100644
> --- a/policy/modules/services/bluetooth.fc
> +++ b/policy/modules/services/bluetooth.fc
> @@ -8,6 +8,10 @@
>  /usr/bin/blue.*pin	--	gen_context(system_u:object_r:bluetooth_helper_exe=
c_t,s0)
>  /usr/bin/bluetoothd	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
>  /usr/bin/bluetoothctl	--	gen_context(system_u:object_r:bluetooth_helper_=
exec_t,s0)
> +/usr/bin/hciconfig  --  gen_context(system_u:object_r:bluetooth_helper_e=
xec_t,s0)
> +/usr/bin/hcidump  --  gen_context(system_u:object_r:bluetooth_helper_exe=
c_t,s0)
> +/usr/bin/hcitool  --  gen_context(system_u:object_r:bluetooth_helper_exe=
c_t,s0)
> +/usr/bin/l2test   --  gen_context(system_u:object_r:bluetooth_helper_exe=
c_t,s0)

These need to be sorted in with the other /usr/bin entries.


>  /usr/bin/dund	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
>  /usr/bin/hciattach	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
>  /usr/bin/hcid	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
> diff --git a/policy/modules/services/bluetooth.te b/policy/modules/servic=
es/bluetooth.te
> index 196922240..f40a16040 100644
> --- a/policy/modules/services/bluetooth.te
> +++ b/policy/modules/services/bluetooth.te
> @@ -182,6 +182,14 @@ allow bluetooth_helper_t bluetooth_t:socket { read w=
rite };
>  allow bluetooth_helper_t bluetooth_t:fd use;
>  allow bluetooth_helper_t bluetooth_t:unix_stream_socket rw_socket_perms;
> =20
> +allow bluetooth_helper_t self:capability { net_admin net_raw };
> +allow bluetooth_helper_t self:bluetooth_socket { getattr getopt bind cre=
ate setopt read };
> +getty_use_fds(bluetooth_helper_t)
> +ssh_use_sshd_pidfds(bluetooth_helper_t)

Instead of these two lines, domain_use_interactive_fds() is probably more a=
pplicable.

> +userdom_use_user_ptys(bluetooth_helper_t)
> +userdom_use_user_ttys(bluetooth_helper_t)

userdom_use_user_terminals() is equivalent to the above two lines.

> +allow bluetooth_helper_t self:bluetooth_socket { ioctl write listen acce=
pt connect };

Please merge the bluetooth_socket lines and use create_socket_perms. Additi=
onally the lines should follow the style guide https://github.com/SELinuxPr=
oject/refpolicy/wiki/StyleGuide


>  manage_dirs_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetoot=
h_helper_tmp_t)
>  manage_files_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetoo=
th_helper_tmp_t)
>  manage_sock_files_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bl=
uetooth_helper_tmp_t)
>=20


=2D-=20
Chris PeBenito