Re: [PATCH] bluetooth: allow bluetooth_helper_t net_admin capability

There is no functional failure, because of avc denial we are fixing.

On 5/1/2026 8:30 PM, Christopher J. PeBenito wrote:
> On 4/30/26 5:37 AM, Yepuri Siddu wrote:
>> Allow bluetooth_helper_t to use the net_admin capability.
>>
>> This fixes the following AVC denial:
>>
>> avc:  denied  { net_admin } for  capability=12
>> scontext=system_u:system_r:bluetooth_helper_t:s0
>> tcontext=system_u:system_r:bluetooth_helper_t:s0
>> tclass=capability permissive=0
>>
>> Add net_admin to the existing self:capability rule for
>> bluetooth_helper_t.
>>
>> Signed-off-by: Yepuri Siddu <[email protected]>
>> ---
>>   policy/modules/services/bluetooth.te | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/policy/modules/services/bluetooth.te b/policy/modules/ 
>> services/bluetooth.te
>> index ceb42d147..dbd3519d4 100644
>> --- a/policy/modules/services/bluetooth.te
>> +++ b/policy/modules/services/bluetooth.te
>> @@ -178,7 +178,7 @@ optional_policy(`
>>   # Helper local policy
>>   #
>> -allow bluetooth_helper_t self:capability sys_nice;
>> +allow bluetooth_helper_t self:capability { sys_nice net_admin };
>>   allow bluetooth_helper_t self:process getsched;
>>   allow bluetooth_helper_t self:fifo_file rw_fifo_file_perms;
>>   allow bluetooth_helper_t self:shm create_shm_perms;
>>
> What functional failure do you see when this is denied? Do you know how 
> it is using this capability?
> 
>