Re: [PATCH v1] obexctl: Add sepolicy for obexctl to work in ssh

--nextPart5290271.OV4Wx5bFTl
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="utf-8"; protected-headers="v1"
From: "Christopher J. PeBenito" <[email protected]>
Date: Fri, 16 Jan 2026 10:16:38 -0500
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>
References: <[email protected]>
MIME-Version: 1.0

On Friday, January 16, 2026 8:59:12=E2=80=AFAM Eastern Standard Time Amisha=
 Jain wrote:
> This fix is required to resolve below AVC denial -
>=20
> audit[635]: USER_AVC pid=3D635 uid=3D999 auid=3D4294967295 ses=3D42949672=
95
> subj=3Dsystem_u:system_r:system_dbusd_t:s0 msg=3D'avc:  denied  { send_ms=
g }
> for msgtype=3Dmethod_return dest=3D:1.47 spid=3D763 tpid=3D1862

Since this is a method_return, it would be clearer to add an optional obex_=
chat() in unconfined.te. I'd prefer it this way, so it's clear that the act=
ion is being done by the unconfined process. Additionally, on dbus-broker s=
ystems, this denial won't be seen, so it would be easier to remove the perm=
ission on those systems.


> scontext=3Dsystem_u:system_r:initrc_t:s0
> tcontext=3Dunconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
> tclass=3Ddbus permissive=3D0 exe=3D"/usr/bin/dbus-daemon" sauid=3D999
> hostname=3D? addr=3D? terminal=3D?'
>=20
> ---
>  policy/modules/services/obex.fc | 1 +
>  policy/modules/services/obex.te | 2 ++
>  2 files changed, 3 insertions(+)
>=20
> diff --git a/policy/modules/services/obex.fc b/policy/modules/services/ob=
ex.fc
> index 03fa56040..dcbefa2c1 100644
> --- a/policy/modules/services/obex.fc
> +++ b/policy/modules/services/obex.fc
> @@ -1 +1,2 @@
>  /usr/bin/obex-data-server	--	gen_context(system_u:object_r:obex_exec_t,s=
0)
> +/usr/libexec/bluetooth/obexd   --      gen_context(system_u:object_r:obe=
x_exec_t,s0)
> diff --git a/policy/modules/services/obex.te b/policy/modules/services/ob=
ex.te
> index 5e2f20578..176050056 100644
> --- a/policy/modules/services/obex.te
> +++ b/policy/modules/services/obex.te
> @@ -30,6 +30,8 @@ miscfiles_read_localization(obex_t)
> =20
>  userdom_search_user_home_content(obex_t)
> =20
> +unconfined_dbus_send(obex_t)
> +
>  optional_policy(`
>  	bluetooth_use(obex_t)
>  ')
>=20


=2D-=20
Chris PeBenito

--nextPart5290271.OV4Wx5bFTl
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part.
Content-Transfer-Encoding: 7Bit

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQTExisWcMLfMxRI8obGNj7xyWl7FAUCaWpWVgAKCRDGNj7xyWl7
FI0mAQD6ENMd5JHcl6YvJ063w1vIlIypvynBkVE1z5F5rxDWvAD/ddcyelcQGjwL
Wm4xnf/cmC6kqpr+QU5JV1CPd8aztw4=
=12Xg
-----END PGP SIGNATURE-----

--nextPart5290271.OV4Wx5bFTl--