Re: [PATCH] bluetooth: allow bluetooth_helper_t net_admin capability

On 4/30/26 5:37 AM, Yepuri Siddu wrote:
> Allow bluetooth_helper_t to use the net_admin capability.
>
> This fixes the following AVC denial:
>
> avc:  denied  { net_admin } for  capability=12
> scontext=system_u:system_r:bluetooth_helper_t:s0
> tcontext=system_u:system_r:bluetooth_helper_t:s0
> tclass=capability permissive=0
>
> Add net_admin to the existing self:capability rule for
> bluetooth_helper_t.
>
> Signed-off-by: Yepuri Siddu <[email protected]>
> ---
>   policy/modules/services/bluetooth.te | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/policy/modules/services/bluetooth.te b/policy/modules/services/bluetooth.te
> index ceb42d147..dbd3519d4 100644
> --- a/policy/modules/services/bluetooth.te
> +++ b/policy/modules/services/bluetooth.te
> @@ -178,7 +178,7 @@ optional_policy(`
>   # Helper local policy
>   #
>   
> -allow bluetooth_helper_t self:capability sys_nice;
> +allow bluetooth_helper_t self:capability { sys_nice net_admin };
>   allow bluetooth_helper_t self:process getsched;
>   allow bluetooth_helper_t self:fifo_file rw_fifo_file_perms;
>   allow bluetooth_helper_t self:shm create_shm_perms;
>
What functional failure do you see when this is denied? Do you know how 
it is using this capability?


-- 
Chris PeBenito