[PATCH v1] sepolicy: Add sepolicy rules for bluetooth Notify failures

From: Damodar Reddy GangiReddy <[email protected]>

Below are the avc denials fixed:
Jan 01 00:05:12 rb3gen2-core-kit audit[642]: AVC avc:  denied  { use } for  pid=642 comm="bluetoothd" path="socket:[27887]" dev="sockfs" ino=27887 scontext=system_u:system_r:bluetooth_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fd permissive=1
Jan 01 00:06:21 rb3gen2-core-kit audit[1555]: AVC avc:  denied  { create } for  pid=1555 comm="bluetoothctl" scontext=system_u:system_r:bluetooth_helper_t:s0 tcontext=system_u:system_r:bluetooth_helper_t:s0 tclass=bluetooth_socket permissive=0
Jan 01 00:03:43 rb3gen2-core-kit audit[696]: AVC avc:  denied  { read write } for  pid=696 comm="dbus-daemon" path="socket:[20251]" dev="sockfs" ino=20251 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

Jan 01 00:22:32 rb3gen2-core-kit audit[2021]: AVC avc:  denied  { read write } for  pid=2021 comm="bluetoothd" path="socket:[25040]" dev="sockfs" ino=25040 scontext=system_u:system_r:bluetooth_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

Signed-off-by: Damodar Reddy GangiReddy <[email protected]>
---
 policy/modules/services/bluetooth.te | 9 +++++++++
 policy/modules/services/dbus.te      | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index 196922240..74ca0b5bb 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -137,6 +137,7 @@ optional_policy(`
 	dbus_system_bus_client(bluetooth_t)
 	dbus_connect_system_bus(bluetooth_t)
 	init_dbus_send_script(bluetooth_t)
+	unconfined_use_fds(bluetooth_t)
 
 	optional_policy(`
 		cups_dbus_chat(bluetooth_t)
@@ -167,6 +168,13 @@ optional_policy(`
 	ppp_domtrans(bluetooth_t)
 ')
 
+optional_policy(`
+    gen_require(`
+        type unconfined_t;
+    ')
+    allow bluetooth_t unconfined_t:unix_stream_socket { read write };
+')
+
 ########################################
 #
 # Helper local policy
@@ -181,6 +189,7 @@ allow bluetooth_helper_t self:unix_stream_socket { accept connectto listen };
 allow bluetooth_helper_t bluetooth_t:socket { read write };
 allow bluetooth_helper_t bluetooth_t:fd use;
 allow bluetooth_helper_t bluetooth_t:unix_stream_socket rw_socket_perms;
+allow bluetooth_helper_t self:bluetooth_socket create;
 
 manage_dirs_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
 manage_files_pattern(bluetooth_helper_t, bluetooth_helper_tmp_t, bluetooth_helper_tmp_t)
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index dd490a705..2af3f8a80 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -317,6 +317,14 @@ optional_policy(`
 	xserver_use_xdm_fds(system_dbusd_t)
 ')
 
+optional_policy(`
+    gen_require(`
+        type unconfined_t;
+    ')
+
+    allow system_dbusd_t unconfined_t:unix_stream_socket { read write };
+')
+
 ########################################
 #
 # Common session bus local policy
-- 
2.34.1