diff --git a/bluetooth.te b/bluetooth.te index c05de059a37713f63c428c3b8e3e892315dcd830..826856c2706d598cd2f7b9fd6464e51827b4ff0a 100644 --- a/bluetooth.te +++ b/bluetooth.te @@ -23,23 +23,11 @@ r_dir_file(bluetooth, bluetooth_efs_file) allow bluetooth { tun_device uhid_device hci_attach_dev }:chr_file rw_file_perms; auditallow bluetooth tun_device:chr_file rw_file_perms; -# Other domains that can create and use bluetooth sockets. -# SELinux does not presently define a specific socket class for -# bluetooth sockets, nor does it distinguish among the bluetooth protocols. -# TODO: This should no longer be needed with bluedroid for bluetooth -# but may be getting used for other non-bluetooth sockets that has no -# specific class defined. Consider taking to specific domains. -allow bluetoothdomain self:socket create_socket_perms; - # sysfs access. allow bluetooth sysfs_bluetooth_writable:file rw_file_perms; allow bluetooth self:capability net_admin; allow bluetooth self:capability2 wake_alarm; -# Allow clients to use a socket provided by the bluetooth app. -# TODO: See if this is still required under bluedroid. -allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown }; - # tethering allow bluetooth self:tun_socket create_socket_perms; allow bluetooth efs_file:dir search; diff --git a/bluetoothdomain.te b/bluetoothdomain.te new file mode 100644 index 0000000000000000000000000000000000000000..9626e4b4b0c7196df4349ce0572802fd3a32654c --- /dev/null +++ b/bluetoothdomain.te @@ -0,0 +1,11 @@ +# Other domains that can create and use bluetooth sockets. +# SELinux does not presently define a specific socket class for +# bluetooth sockets, nor does it distinguish among the bluetooth protocols. +# TODO: This should no longer be needed with bluedroid for bluetooth +# but may be getting used for other non-bluetooth sockets that has no +# specific class defined. Consider taking to specific domains. +allow bluetoothdomain self:socket create_socket_perms; + +# Allow clients to use a socket provided by the bluetooth app. +# TODO: See if this is still required under bluedroid. +allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };