Re: [PATCH] sepolicy: Allow bluetooth to send D-Bus messages to systemd

On 4/3/26 2:31 AM, Wei Deng wrote:
> Add init_dbus_chat() for bluetooth_t to allow bluetoothd to send
> D-Bus method_return messages back to systemd (init_t) over the
> system bus.
>
> Below avc denial is fixed with this patch:
>
> avc:  denied  { send_msg } for  msgtype=method_return dest=:1.11
> scontext=system_u:system_r:bluetooth_t:s0
> tcontext=system_u:system_r:init_t:s0 tclass=dbus permissive=0
>
> Signed-off-by: Wei Deng <[email protected]>
> ---
>   policy/modules/services/bluetooth.te | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
> index ceb42d147..a73cb5db0 100644
> --- a/policy/modules/services/bluetooth.te
> +++ b/policy/modules/services/bluetooth.te
> @@ -136,6 +136,7 @@ userdom_dontaudit_search_user_home_dirs(bluetooth_t)
>   optional_policy(`
>   	dbus_system_bus_client(bluetooth_t)
>   	dbus_connect_system_bus(bluetooth_t)
> +  init_dbus_chat(bluetooth_t)
>   	init_dbus_send_script(bluetooth_t)
>   
>   	optional_policy(`

Can you confirm this response is going to systemd/pid1? Is there a 
fuller set of log messages corresponding to this denial? The 
init_dbus_send_script() makes me wonder.

-- 
Chris PeBenito