[PATCH v2] sepolicy: Add sepolicy rules for bluetooth Notify failures

From: Damodar Reddy GangiReddy <[email protected]>

Below are the avc denials fixed:
Jan 01 00:05:12 rb3gen2-core-kit audit[642]: AVC avc:  denied  { use } for  pid=642 comm="bluetoothd" path="socket:[27887]" dev="sockfs" ino=27887 scontext=system_u:system_r:bluetooth_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=fd permissive=1
Jan 01 00:06:21 rb3gen2-core-kit audit[1555]: AVC avc:  denied  { create } for  pid=1555 comm="bluetoothctl" scontext=system_u:system_r:bluetooth_helper_t:s0 tcontext=system_u:system_r:bluetooth_helper_t:s0 tclass=bluetooth_socket permissive=0
Jan 01 00:03:43 rb3gen2-core-kit audit[696]: AVC avc:  denied  { read write } for  pid=696 comm="dbus-daemon" path="socket:[20251]" dev="sockfs" ino=20251 scontext=system_u:system_r:system_dbusd_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

Jan 01 00:22:32 rb3gen2-core-kit audit[2021]: AVC avc:  denied  { read write } for  pid=2021 comm="bluetoothd" path="socket:[25040]" dev="sockfs" ino=25040 scontext=system_u:system_r:bluetooth_t:s0 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

Signed-off-by: Damodar Reddy GangiReddy <[email protected]>
---
 policy/modules/services/bluetooth.te |  9 +++++++++
 policy/modules/services/dbus.te      |  4 ++++
 policy/modules/system/unconfined.if  | 16 ++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
index 196922240..1961d7e73 100644
--- a/policy/modules/services/bluetooth.te
+++ b/policy/modules/services/bluetooth.te
@@ -157,6 +157,14 @@ optional_policy(`
 	optional_policy(`
 		systemd_dbus_chat_hostnamed(bluetooth_t)
 	')
+
+	optional_policy(`
+	    unconfined_use_fds(bluetooth_t)
+	')
+
+	optional_policy(`
+	    unconfined_rw_unix_stream_socket(bluetooth_t)
+	')
 ')
 
 optional_policy(`
@@ -177,6 +185,7 @@ allow bluetooth_helper_t self:process getsched;
 allow bluetooth_helper_t self:fifo_file rw_fifo_file_perms;
 allow bluetooth_helper_t self:shm create_shm_perms;
 allow bluetooth_helper_t self:unix_stream_socket { accept connectto listen };
+allow bluetooth_helper_t self:bluetooth_socket create_socket_perms;
 
 allow bluetooth_helper_t bluetooth_t:socket { read write };
 allow bluetooth_helper_t bluetooth_t:fd use;
diff --git a/policy/modules/services/dbus.te b/policy/modules/services/dbus.te
index dd490a705..afed5b007 100644
--- a/policy/modules/services/dbus.te
+++ b/policy/modules/services/dbus.te
@@ -317,6 +317,10 @@ optional_policy(`
 	xserver_use_xdm_fds(system_dbusd_t)
 ')
 
+optional_policy(`
+    unconfined_rw_unix_stream_socket(system_dbusd_t)
+')
+
 ########################################
 #
 # Common session bus local policy
diff --git a/policy/modules/system/unconfined.if b/policy/modules/system/unconfined.if
index f3e5d3001..4299bc87f 100644
--- a/policy/modules/system/unconfined.if
+++ b/policy/modules/system/unconfined.if
@@ -668,3 +668,19 @@ interface(`unconfined_unix_dgram_send',`
 
 	allow $1 unconfined_t:unix_dgram_socket sendto;
 ')
+
+########################################
+## <summary>
+##      Allow a domain to read and write to unconfined unix stream sockets.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain to grant permission to.
+##      </summary>
+## </param>
+interface(`unconfined_rw_unix_stream_socket',`
+    gen_require(`
+        type unconfined_t;
+    ')
+    allow $1 unconfined_t:unix_stream_socket { read write };
+')
-- 
2.34.1