[PATCH v2] obex: transfer obexd to obex_t

obexd was running under init_t instead of obex_t because obex.te
only declared userdom_user_application_domain(), which does not
set up a domain transition from init_t.  Add init_daemon_domain()
so that obexd exec'd by init/systemd correctly transitions to obex_t.

Also add the permissions observed to be required when obexd runs
as obex_t: read sysfs nodes (dev_read_sysfs), register on the
D-Bus system bus (dbus_connect_system_bus), and get attributes
of bluetooth var-lib directories via the new
bluetooth_getattr_var_lib_dirs() interface.

Fixes:
avc:  denied  { read } for  pid=1751 comm="obexd" name="enabled" dev="sysfs" ino=21530 scontext=system_u:system_r:obex_t:s0 tcontext=system_u:object_r:sysfs_t:s0 tclass=file permissive=0

avc:  denied  { acquire_svc } for service=org.bluez.obex spid=1755 scontext=system_u:system_r:obex_t:s0 tcontext=system_u:system_r:system_dbusd_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-daemon" sauid=998 hostname=? addr=? terminal=?

avc:  denied  { getattr } for  pid=1826 comm="obexd" path="/var/lib/bluetooth" dev="sda2" ino=1038914 scontext=system_u:system_r:obex_t:s0 tcontext=system_u:object_r:bluetooth_var_lib_t:s0 tclass=dir permissive=0

Signed-off-by: Wei Deng <[email protected]>
---
Changes in v2:
- Complete rework: investigation showed the AVC denial was not
  bluetooth_t -> init_t (systemd), but bluetooth_t -> init_t (obexd
  running in the wrong domain because obex.te lacked a domain
  transition from init_t).  The v1 fix of adding init_dbus_chat() to
  bluetooth.te was therefore incorrect.
- Fix the root cause by adding init_daemon_domain() to obex.te so
  obexd correctly transitions to obex_t when started by init/systemd.
- Add permissions needed by obexd once it runs as obex_t: dev_read_sysfs,
  dbus_connect_system_bus, and bluetooth_getattr_var_lib_dirs (new
  interface in bluetooth.if).

 policy/modules/services/bluetooth.if | 19 +++++++++++++++++++
 policy/modules/services/obex.te      |  5 +++++
 2 files changed, 24 insertions(+)

diff --git a/policy/modules/services/bluetooth.if b/policy/modules/services/bluetooth.if
index d0e581426..f8226969f 100644
--- a/policy/modules/services/bluetooth.if
+++ b/policy/modules/services/bluetooth.if
@@ -255,6 +255,25 @@ interface(`bluetooth_admin',`
 	admin_pattern($1, bluetooth_runtime_t)
 ')
 
+########################################
+## <summary>
+##	Get the attributes of bluetooth lib directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`bluetooth_getattr_var_lib_dirs',`
+	gen_require(`
+		type bluetooth_var_lib_t;
+	')
+
+	allow $1 bluetooth_var_lib_t:dir getattr_dir_perms;
+	files_search_var_lib($1)
+')
+
 ########################################
 ## <summary>
 ##      Get status of bluetooth_unit_t service
diff --git a/policy/modules/services/obex.te b/policy/modules/services/obex.te
index 5e2f20578..6803123b1 100644
--- a/policy/modules/services/obex.te
+++ b/policy/modules/services/obex.te
@@ -9,6 +9,7 @@ attribute_role obex_roles;
 
 type obex_t;
 type obex_exec_t;
+init_daemon_domain(obex_t, obex_exec_t)
 userdom_user_application_domain(obex_t, obex_exec_t)
 role obex_roles types obex_t;
 
@@ -20,6 +21,8 @@ role obex_roles types obex_t;
 allow obex_t self:fifo_file rw_fifo_file_perms;
 allow obex_t self:socket create_stream_socket_perms;
 
+dev_read_sysfs(obex_t)
+
 dev_read_urand(obex_t)
 
 files_read_etc_files(obex_t)
@@ -32,10 +35,12 @@ userdom_search_user_home_content(obex_t)
 
 optional_policy(`
 	bluetooth_use(obex_t)
+	bluetooth_getattr_var_lib_dirs(obex_t)
 ')
 
 optional_policy(`
 	dbus_system_bus_client(obex_t)
+	dbus_connect_system_bus(obex_t)
 
 	optional_policy(`
 		bluetooth_dbus_chat(obex_t)
-- 
2.34.1