1bluetooth_helper_selinux(S8E)Linux Policy bluetooth_helbpleuretooth_helper_selinux(8)
2
6 bluetooth_helper_selinux - Security Enhanced Linux Policy for the blue‐
7 tooth_helper processes
8
10 Security-Enhanced Linux secures the bluetooth_helper processes via
11 flexible mandatory access control.
12 The bluetooth_helper processes execute with the bluetooth_helper_t
14 SELinux type. You can check if you have these processes running by exe‐
15 cuting the ps command with the -Z qualifier.
16 For example:
18 ps -eZ | grep bluetooth_helper_t
20
24 The bluetooth_helper_t SELinux type can be entered via the blue‐
25 tooth_helper_exec_t file type.
26 The default entrypoint paths for the bluetooth_helper_t domain are the
28 following:
29 /usr/bin/blue.*pin
31
33 SELinux defines process types (domains) for each process running on the
34 system
35 You can see the context of a process using the -Z option to ps
37 Policy governs the access confined processes have to files. SELinux
39 bluetooth_helper policy is very flexible allowing users to setup their
40 bluetooth_helper processes in as secure a method as possible.
41 The following process types are defined for bluetooth_helper:
43 bluetooth_helper_t
45 Note: semanage permissive -a bluetooth_helper_t can be used to make the
47 process type bluetooth_helper_t permissive. SELinux does not deny
48 access to permissive process types, but the AVC (SELinux denials) mes‐
49 sages are still generated.
50
53 SELinux policy is customizable based on least access required. blue‐
54 tooth_helper policy is extremely flexible and has several booleans that
55 allow you to manipulate the policy and run bluetooth_helper with the
56 tightest access possible.
57 If you want to allow all domains to use other domains file descriptors,
61 you must turn on the allow_domain_fd_use boolean. Enabled by default.
62 setsebool -P allow_domain_fd_use 1
64 If you want to allow sysadm to debug or ptrace all processes, you must
68 turn on the allow_ptrace boolean. Disabled by default.
69 setsebool -P allow_ptrace 1
71 If you want to allows clients to write to the X server shared memory
75 segments, you must turn on the allow_write_xshm boolean. Disabled by
76 default.
77 setsebool -P allow_write_xshm 1
79 If you want to allow all domains to have the kernel load modules, you
83 must turn on the domain_kernel_load_modules boolean. Disabled by
84 default.
85 setsebool -P domain_kernel_load_modules 1
87 If you want to allow all domains to execute in fips_mode, you must turn
91 on the fips_mode boolean. Enabled by default.
92 setsebool -P fips_mode 1
94 If you want to enable reading of urandom for all domains, you must turn
98 on the global_ssp boolean. Disabled by default.
99 setsebool -P global_ssp 1
101 If you want to support NFS home directories, you must turn on the
105 use_nfs_home_dirs boolean. Disabled by default.
106 setsebool -P use_nfs_home_dirs 1
108 If you want to support SAMBA home directories, you must turn on the
112 use_samba_home_dirs boolean. Disabled by default.
113 setsebool -P use_samba_home_dirs 1
115 If you want to support X userspace object manager, you must turn on the
119 xserver_object_manager boolean. Disabled by default.
120 setsebool -P xserver_object_manager 1
122
126 The SELinux process type bluetooth_helper_t can manage files labeled
127 with the following file types. The paths listed are the default paths
128 for these file types. Note the processes UID still need to have DAC
129 permissions.
130 bluetooth_helper_tmp_t
132 bluetooth_helper_tmpfs_t
135 initrc_tmp_t
138 mnt_t
141 /mnt(/[^/]*)
143 /mnt(/[^/]*)?
144 /rhev(/[^/]*)?
145 /media(/[^/]*)
146 /media(/[^/]*)?
147 /etc/rhgb(/.*)?
148 /media/.hal-.*
149 /net
150 /afs
151 /rhev
152 /misc
153 tmp_t
155 /tmp
157 /usr/tmp
158 /var/tmp
159 /tmp-inst
160 /var/tmp-inst
161 /var/tmp/vi.recover
162 user_fonts_cache_t
164 /home/[^/]*/.fonts/auto(/.*)?
166 /home/[^/]*/.fontconfig(/.*)?
167 /home/[^/]*/.fonts.cache-.*
168 /home/staff/.fonts/auto(/.*)?
169 /home/staff/.fontconfig(/.*)?
170 /home/staff/.fonts.cache-.*
171 xserver_tmpfs_t
173
177 SELinux requires files to have an extended attribute to define the file
178 type.
179 You can see the context of a file using the -Z option to ls
181 Policy governs the access confined processes have to these files.
183 SELinux bluetooth_helper policy is very flexible allowing users to set‐
184 up their bluetooth_helper processes in as secure a method as possible.
185 STANDARD FILE CONTEXT
187 SELinux defines the file context types for the bluetooth_helper, if you
189 wanted to store files with these types in a diffent paths, you need to
190 execute the semanage command to sepecify alternate labeling and then
191 use restorecon to put the labels on disk.
192 semanage fcontext -a -t bluetooth_helper_tmpfs_t '/srv/myblue‐
194 tooth_helper_content(/.*)?'
195 restorecon -R -v /srv/mybluetooth_helper_content
196 Note: SELinux often uses regular expressions to specify labels that
198 match multiple files.
199 The following file types are defined for bluetooth_helper:
201 bluetooth_helper_exec_t
205 - Set files with the bluetooth_helper_exec_t type, if you want to tran‐
207 sition an executable to the bluetooth_helper_t domain.
208 bluetooth_helper_tmp_t
212 - Set files with the bluetooth_helper_tmp_t type, if you want to store
214 bluetooth helper temporary files in the /tmp directories.
215 bluetooth_helper_tmpfs_t
219 - Set files with the bluetooth_helper_tmpfs_t type, if you want to
221 store bluetooth helper files on a tmpfs file system.
222 Note: File context can be temporarily modified with the chcon command.
226 If you want to permanently change the file context you need to use the
227 semanage fcontext command. This will modify the SELinux labeling data‐
228 base. You will need to use restorecon to apply the labels.
229
232 semanage fcontext can also be used to manipulate default file context
233 mappings.
234 semanage permissive can also be used to manipulate whether or not a
236 process type is permissive.
237 semanage module can also be used to enable/disable/install/remove pol‐
239 icy modules.
240 semanage boolean can also be used to manipulate the booleans
242 system-config-selinux is a GUI tool available to customize SELinux pol‐
245 icy settings.
246
249 This manual page was auto-generated using sepolicy manpage .
250
253 selinux(8), bluetooth_helper(8), semanage(8), restorecon(8), chcon(1) ,
254 setsebool(8)
255bluetooth_helper 15-06-03 bluetooth_helper_selinux(8)