1bluetooth_selinux(8) SELinux Policy bluetooth bluetooth_selinux(8)
2
3
4
6 bluetooth_selinux - Security Enhanced Linux Policy for the bluetooth
7 processes
8
10 Security-Enhanced Linux secures the bluetooth processes via flexible
11 mandatory access control.
12
13 The bluetooth processes execute with the bluetooth_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep bluetooth_t
20
21
22
24 The bluetooth_t SELinux type can be entered via the bluetooth_exec_t
25 file type.
26
27 The default entrypoint paths for the bluetooth_t domain are the follow‐
28 ing:
29
30 /usr/bin/dund, /usr/bin/hidd, /usr/bin/pand, /usr/sbin/hcid,
31 /usr/sbin/sdpd, /usr/bin/rfcomm, /usr/sbin/hid2hci, /usr/sbin/hciat‐
32 tach, /usr/sbin/bluetoothd, /usr/libexec/bluetooth/bluetoothd
33
35 SELinux defines process types (domains) for each process running on the
36 system
37
38 You can see the context of a process using the -Z option to ps
39
40 Policy governs the access confined processes have to files. SELinux
41 bluetooth policy is very flexible allowing users to setup their blue‐
42 tooth processes in as secure a method as possible.
43
44 The following process types are defined for bluetooth:
45
46 bluetooth_t, bluetooth_helper_t
47
48 Note: semanage permissive -a bluetooth_t can be used to make the
49 process type bluetooth_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
53
55 SELinux policy is customizable based on least access required. blue‐
56 tooth policy is extremely flexible and has several booleans that allow
57 you to manipulate the policy and run bluetooth with the tightest access
58 possible.
59
60
61
62 If you want to allow users to resolve user passwd entries directly from
63 ldap rather then using a sssd server, you must turn on the authlo‐
64 gin_nsswitch_use_ldap boolean. Disabled by default.
65
66 setsebool -P authlogin_nsswitch_use_ldap 1
67
68
69
70 If you want to deny all system processes and Linux users to use blue‐
71 tooth wireless technology, you must turn on the deny_bluetooth boolean.
72 Enabled by default.
73
74 setsebool -P deny_bluetooth 1
75
76
77
78 If you want to allow all domains to execute in fips_mode, you must turn
79 on the fips_mode boolean. Enabled by default.
80
81 setsebool -P fips_mode 1
82
83
84
85 If you want to allow confined applications to run with kerberos, you
86 must turn on the kerberos_enabled boolean. Enabled by default.
87
88 setsebool -P kerberos_enabled 1
89
90
91
92 If you want to allow system to run with NIS, you must turn on the
93 nis_enabled boolean. Disabled by default.
94
95 setsebool -P nis_enabled 1
96
97
98
99 If you want to allow confined applications to use nscd shared memory,
100 you must turn on the nscd_use_shm boolean. Disabled by default.
101
102 setsebool -P nscd_use_shm 1
103
104
105
106 If you want to allow xguest to use blue tooth devices, you must turn on
107 the xguest_use_bluetooth boolean. Enabled by default.
108
109 setsebool -P xguest_use_bluetooth 1
110
111
112
114 The SELinux process type bluetooth_t can manage files labeled with the
115 following file types. The paths listed are the default paths for these
116 file types. Note the processes UID still need to have DAC permissions.
117
118 bluetooth_conf_rw_t
119
120 /etc/bluetooth/link_key
121
122 bluetooth_lock_t
123
124 /var/lock/subsys/bluetoothd
125
126 bluetooth_tmp_t
127
128
129 bluetooth_var_lib_t
130
131 /var/lib/bluetooth(/.*)?
132
133 bluetooth_var_run_t
134
135 /var/run/sdp
136 /var/run/bluetoothd_address
137
138 cluster_conf_t
139
140 /etc/cluster(/.*)?
141
142 cluster_var_lib_t
143
144 /var/lib/pcsd(/.*)?
145 /var/lib/cluster(/.*)?
146 /var/lib/openais(/.*)?
147 /var/lib/pengine(/.*)?
148 /var/lib/corosync(/.*)?
149 /usr/lib/heartbeat(/.*)?
150 /var/lib/heartbeat(/.*)?
151 /var/lib/pacemaker(/.*)?
152
153 cluster_var_run_t
154
155 /var/run/crm(/.*)?
156 /var/run/cman_.*
157 /var/run/rsctmp(/.*)?
158 /var/run/aisexec.*
159 /var/run/heartbeat(/.*)?
160 /var/run/corosync-qnetd(/.*)?
161 /var/run/corosync-qdevice(/.*)?
162 /var/run/corosync.pid
163 /var/run/cpglockd.pid
164 /var/run/rgmanager.pid
165 /var/run/cluster/rgmanager.sk
166
167 root_t
168
169 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
170 /
171 /initrd
172
173 sysfs_t
174
175 /sys(/.*)?
176
177 usbfs_t
178
179
180
182 SELinux requires files to have an extended attribute to define the file
183 type.
184
185 You can see the context of a file using the -Z option to ls
186
187 Policy governs the access confined processes have to these files.
188 SELinux bluetooth policy is very flexible allowing users to setup their
189 bluetooth processes in as secure a method as possible.
190
191 STANDARD FILE CONTEXT
192
193 SELinux defines the file context types for the bluetooth, if you wanted
194 to store files with these types in a diffent paths, you need to execute
195 the semanage command to sepecify alternate labeling and then use
196 restorecon to put the labels on disk.
197
198 semanage fcontext -a -t bluetooth_unit_file_t '/srv/mybluetooth_con‐
199 tent(/.*)?'
200 restorecon -R -v /srv/mybluetooth_content
201
202 Note: SELinux often uses regular expressions to specify labels that
203 match multiple files.
204
205 The following file types are defined for bluetooth:
206
207
208
209 bluetooth_conf_rw_t
210
211 - Set files with the bluetooth_conf_rw_t type, if you want to treat the
212 files as bluetooth conf read/write content.
213
214
215
216 bluetooth_conf_t
217
218 - Set files with the bluetooth_conf_t type, if you want to treat the
219 files as bluetooth configuration data, usually stored under the /etc
220 directory.
221
222
223
224 bluetooth_exec_t
225
226 - Set files with the bluetooth_exec_t type, if you want to transition
227 an executable to the bluetooth_t domain.
228
229
230 Paths:
231 /usr/bin/dund, /usr/bin/hidd, /usr/bin/pand, /usr/sbin/hcid,
232 /usr/sbin/sdpd, /usr/bin/rfcomm, /usr/sbin/hid2hci, /usr/sbin/hci‐
233 attach, /usr/sbin/bluetoothd, /usr/libexec/bluetooth/bluetoothd
234
235
236 bluetooth_helper_exec_t
237
238 - Set files with the bluetooth_helper_exec_t type, if you want to tran‐
239 sition an executable to the bluetooth_helper_t domain.
240
241
242
243 bluetooth_helper_tmp_t
244
245 - Set files with the bluetooth_helper_tmp_t type, if you want to store
246 bluetooth helper temporary files in the /tmp directories.
247
248
249
250 bluetooth_helper_tmpfs_t
251
252 - Set files with the bluetooth_helper_tmpfs_t type, if you want to
253 store bluetooth helper files on a tmpfs file system.
254
255
256
257 bluetooth_initrc_exec_t
258
259 - Set files with the bluetooth_initrc_exec_t type, if you want to tran‐
260 sition an executable to the bluetooth_initrc_t domain.
261
262
263 Paths:
264 /etc/rc.d/init.d/dund, /etc/rc.d/init.d/pand,
265 /etc/rc.d/init.d/bluetooth
266
267
268 bluetooth_lock_t
269
270 - Set files with the bluetooth_lock_t type, if you want to treat the
271 files as bluetooth lock data, stored under the /var/lock directory
272
273
274
275 bluetooth_tmp_t
276
277 - Set files with the bluetooth_tmp_t type, if you want to store blue‐
278 tooth temporary files in the /tmp directories.
279
280
281
282 bluetooth_unit_file_t
283
284 - Set files with the bluetooth_unit_file_t type, if you want to treat
285 the files as bluetooth unit content.
286
287
288
289 bluetooth_var_lib_t
290
291 - Set files with the bluetooth_var_lib_t type, if you want to store the
292 bluetooth files under the /var/lib directory.
293
294
295
296 bluetooth_var_run_t
297
298 - Set files with the bluetooth_var_run_t type, if you want to store the
299 bluetooth files under the /run or /var/run directory.
300
301
302 Paths:
303 /var/run/sdp, /var/run/bluetoothd_address
304
305
306 Note: File context can be temporarily modified with the chcon command.
307 If you want to permanently change the file context you need to use the
308 semanage fcontext command. This will modify the SELinux labeling data‐
309 base. You will need to use restorecon to apply the labels.
310
311
313 semanage fcontext can also be used to manipulate default file context
314 mappings.
315
316 semanage permissive can also be used to manipulate whether or not a
317 process type is permissive.
318
319 semanage module can also be used to enable/disable/install/remove pol‐
320 icy modules.
321
322 semanage boolean can also be used to manipulate the booleans
323
324
325 system-config-selinux is a GUI tool available to customize SELinux pol‐
326 icy settings.
327
328
330 This manual page was auto-generated using sepolicy manpage .
331
332
334 selinux(8), bluetooth(8), semanage(8), restorecon(8), chcon(1), sepol‐
335 icy(8), setsebool(8), bluetooth_helper_selinux(8), blue‐
336 tooth_helper_selinux(8)
337
338
339
340bluetooth 19-06-18 bluetooth_selinux(8)