Re: [REPLY PATCH v1] sepolicy: Add sepolicy rules for hcidump, hciconfig, hcitool and l2test failures

--nextPart27288595.1r3eYUQgxm
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
From: "Christopher J. PeBenito" <[email protected]>
Date: Fri, 09 Jan 2026 09:55:06 -0500
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
MIME-Version: 1.0

On Friday, January 9, 2026 6:09:43=E2=80=AFAM Eastern Standard Time Amisha =
Jain (QUIC) wrote:
> Hi,
>=20
> > -----Original Message-----
> > From: Christopher J. PeBenito <[email protected]>
> > Sent: Wednesday, January 7, 2026 9:15 PM
> > To: [email protected]; Amisha Jain (QUIC)
> > <[email protected]>
> > Cc: Mohammed Sameer Mulla (QUIC) <[email protected]>;
> > Harish Bandi (QUIC) <[email protected]>; Anubhav Gupta (QUIC)
> > <[email protected]>
> > Subject: Re: [PATCH v1] sepolicy: Add sepolicy rules for hcidump, hcico=
nfig,
> > hcitool and l2test failures
> >=20
> > On Wednesday, January 7, 2026 5:08:38=E2=80=AFAM Eastern Standard Time =
Amisha
> > Jain wrote:
> > > Fix to resolve below avc denials -
> > >
> > > AVC avc:  denied  { ioctl } for  pid=3D1884 comm=3D"hciconfig"
> > path=3D"socket:[23486]" dev=3D"sockfs"
> > > ino=3D23486 ioctlcmd=3D0x48d2
> > > scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tclass=3Dbluetooth_socket
> > > permissive=3D0
> > >
> > > AVC avc:  denied  { net_raw } for  pid=3D1917 comm=3D"hcidump"
> > > capability=3D13
> > > scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tclass=3Dcapability
> > > permissive=3D0
> >=20
> > You added net_admin too. Is that from hcidump too?
> >=20
>=20
> net_admin is added for below avc denial -
> audit(1742904136.181:1708): avc:  denied  { net_admin } for  pid=3D1791 c=
omm=3D"bluetoothctl" capability=3D12  scontext=3Droot:sysadm_r:bluetooth_he=
lper_t:s0-s0:c0.c1023 tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.=
c1023 tclass=3Dcapability permissive=3D0

Please add a comment for the rule explaining this (for both capabilities)


> > > AVC avc:  denied  { write } for  pid=3D1905 comm=3D"hcitool"
> > path=3D"socket:[28744]" dev=3D"sockfs"
> > > ino=3D28744 scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tclass=3Dbluetooth_socket
> > > permissive=3D0
> > >
> > > AVC avc:  denied  { listen } for  pid=3D8149 comm=3D"l2test"
> > > scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tclass=3Dbluetooth_socket
> > > permissive=3D0
> > >
> > > AVC avc:  denied  { accept } for  pid=3D1959 comm=3D"l2test"
> > > scontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tcontext=3Droot:sysadm_r:bluetooth_helper_t:s0-s0:c0.c1023
> > > tclass=3Dbluetooth_socket
> > > permissive=3D0
> > >
> > > ---
> > >  policy/modules/services/bluetooth.fc | 4 ++++
> > > policy/modules/services/bluetooth.te | 8 ++++++++
> > >  2 files changed, 12 insertions(+)
[...]

> >=20
> > >  /usr/bin/dund	--
> > 	gen_context(system_u:object_r:bluetooth_exec_t,s0)
> > >  /usr/bin/hciattach	--
> > 	gen_context(system_u:object_r:bluetooth_exec_t,s0)
> > >  /usr/bin/hcid	--	gen_context(system_u:object_r:bluetooth_exec_t,s0)
> > > diff --git a/policy/modules/services/bluetooth.te
> > > b/policy/modules/services/bluetooth.te
> > > index 196922240..f40a16040 100644
> > > --- a/policy/modules/services/bluetooth.te
> > > +++ b/policy/modules/services/bluetooth.te
> > > @@ -182,6 +182,14 @@ allow bluetooth_helper_t bluetooth_t:socket {
> > > read write };  allow bluetooth_helper_t bluetooth_t:fd use;  allow
> > > bluetooth_helper_t bluetooth_t:unix_stream_socket rw_socket_perms;
> > >
> > > +allow bluetooth_helper_t self:capability { net_admin net_raw }; allow
> > > +bluetooth_helper_t self:bluetooth_socket { getattr getopt bind create
> > > +setopt read };
> > > +getty_use_fds(bluetooth_helper_t)
> > > +ssh_use_sshd_pidfds(bluetooth_helper_t)
> >=20
> > Instead of these two lines, domain_use_interactive_fds() is probably mo=
re
> > applicable.
> >=20
>=20
> Using domain_use_interactive_fds will definitly work but it gives use per=
mission for many other domains apart from ssh and getty.
> For example it will give permission to semanage_t, local_login_t, udev_t,=
 init_t and many more domains which is unnecessary and not really required =
by bluetooth_helper_t.

Perhaps, but since bluetooh_helper_t encompasses CLI programs, it could fea=
sibly be ran by these other domains in other scenarios. Since they are high=
ly trusted source domains, inheriting fds from them should be safe.


=2D-=20
Chris PeBenito
--nextPart27288595.1r3eYUQgxm
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTExisWcMLfMxRI8obGNj7xyWl7FAUCaWEWygAKCRDGNj7xyWl7
FJsQAP9ur51jpH+R7FqJIrIdlQLgb5xdXY5o4JqPivm8TID57wEAhgzUHUqPuXcs
PaXd9cxT1KfNfh+/mEkABgE57y9WAQM=
=qtk0
-----END PGP SIGNATURE-----

--nextPart27288595.1r3eYUQgxm--