1bluetooth_selinux(8) SELinux Policy bluetooth bluetooth_selinux(8)
2
3
4
6 bluetooth_selinux - Security Enhanced Linux Policy for the bluetooth
7 processes
8
10 Security-Enhanced Linux secures the bluetooth processes via flexible
11 mandatory access control.
12
13 The bluetooth processes execute with the bluetooth_t SELinux type. You
14 can check if you have these processes running by executing the ps com‐
15 mand with the -Z qualifier.
16
17 For example:
18
19 ps -eZ | grep bluetooth_t
20
21
22
24 The bluetooth_t SELinux type can be entered via the bluetooth_exec_t
25 file type.
26
27 The default entrypoint paths for the bluetooth_t domain are the follow‐
28 ing:
29
30 /usr/bin/dund, /usr/bin/hidd, /usr/bin/pand, /usr/sbin/hcid,
31 /usr/sbin/sdpd, /usr/bin/rfcomm, /usr/sbin/hid2hci, /usr/sbin/hciat‐
32 tach, /usr/sbin/bluetoothd, /usr/libexec/bluetooth/bluetoothd
33
35 SELinux defines process types (domains) for each process running on the
36 system
37
38 You can see the context of a process using the -Z option to ps
39
40 Policy governs the access confined processes have to files. SELinux
41 bluetooth policy is very flexible allowing users to setup their blue‐
42 tooth processes in as secure a method as possible.
43
44 The following process types are defined for bluetooth:
45
46 bluetooth_t, bluetooth_helper_t
47
48 Note: semanage permissive -a bluetooth_t can be used to make the
49 process type bluetooth_t permissive. SELinux does not deny access to
50 permissive process types, but the AVC (SELinux denials) messages are
51 still generated.
52
53
55 SELinux policy is customizable based on least access required. blue‐
56 tooth policy is extremely flexible and has several booleans that allow
57 you to manipulate the policy and run bluetooth with the tightest access
58 possible.
59
60
61
62 If you want to dontaudit all daemons scheduling requests (setsched,
63 sys_nice), you must turn on the daemons_dontaudit_scheduling boolean.
64 Enabled by default.
65
66 setsebool -P daemons_dontaudit_scheduling 1
67
68
69
70 If you want to deny all system processes and Linux users to use blue‐
71 tooth wireless technology, you must turn on the deny_bluetooth boolean.
72 Disabled by default.
73
74 setsebool -P deny_bluetooth 1
75
76
77
78 If you want to allow all domains to execute in fips_mode, you must turn
79 on the fips_mode boolean. Enabled by default.
80
81 setsebool -P fips_mode 1
82
83
84
85 If you want to allow system to run with NIS, you must turn on the
86 nis_enabled boolean. Disabled by default.
87
88 setsebool -P nis_enabled 1
89
90
91
92 If you want to allow xguest to use blue tooth devices, you must turn on
93 the xguest_use_bluetooth boolean. Enabled by default.
94
95 setsebool -P xguest_use_bluetooth 1
96
97
98
100 The SELinux process type bluetooth_t can manage files labeled with the
101 following file types. The paths listed are the default paths for these
102 file types. Note the processes UID still need to have DAC permissions.
103
104 bluetooth_conf_rw_t
105
106 /etc/bluetooth/link_key
107
108 bluetooth_lock_t
109
110 /var/lock/subsys/bluetoothd
111
112 bluetooth_tmp_t
113
114
115 bluetooth_var_lib_t
116
117 /var/lib/bluetooth(/.*)?
118
119 bluetooth_var_run_t
120
121 /var/run/sdp
122 /var/run/bluetoothd_address
123
124 cluster_conf_t
125
126 /etc/cluster(/.*)?
127
128 cluster_var_lib_t
129
130 /var/lib/pcsd(/.*)?
131 /var/lib/cluster(/.*)?
132 /var/lib/openais(/.*)?
133 /var/lib/pengine(/.*)?
134 /var/lib/corosync(/.*)?
135 /usr/lib/heartbeat(/.*)?
136 /var/lib/heartbeat(/.*)?
137 /var/lib/pacemaker(/.*)?
138
139 cluster_var_run_t
140
141 /var/run/crm(/.*)?
142 /var/run/cman_.*
143 /var/run/rsctmp(/.*)?
144 /var/run/aisexec.*
145 /var/run/heartbeat(/.*)?
146 /var/run/pcsd-ruby.socket
147 /var/run/corosync-qnetd(/.*)?
148 /var/run/corosync-qdevice(/.*)?
149 /var/run/corosync.pid
150 /var/run/cpglockd.pid
151 /var/run/rgmanager.pid
152 /var/run/cluster/rgmanager.sk
153
154 krb5_host_rcache_t
155
156 /var/tmp/krb5_0.rcache2
157 /var/cache/krb5rcache(/.*)?
158 /var/tmp/nfs_0
159 /var/tmp/DNS_25
160 /var/tmp/host_0
161 /var/tmp/imap_0
162 /var/tmp/HTTP_23
163 /var/tmp/HTTP_48
164 /var/tmp/ldap_55
165 /var/tmp/ldap_487
166 /var/tmp/ldapmap1_0
167
168 root_t
169
170 /sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
171 /
172 /initrd
173
174 sysfs_t
175
176 /sys(/.*)?
177
178 usbfs_t
179
180
181
183 SELinux requires files to have an extended attribute to define the file
184 type.
185
186 You can see the context of a file using the -Z option to ls
187
188 Policy governs the access confined processes have to these files.
189 SELinux bluetooth policy is very flexible allowing users to setup their
190 bluetooth processes in as secure a method as possible.
191
192 STANDARD FILE CONTEXT
193
194 SELinux defines the file context types for the bluetooth, if you wanted
195 to store files with these types in a different paths, you need to exe‐
196 cute the semanage command to specify alternate labeling and then use
197 restorecon to put the labels on disk.
198
199 semanage fcontext -a -t bluetooth_exec_t '/srv/bluetooth/content(/.*)?'
200 restorecon -R -v /srv/mybluetooth_content
201
202 Note: SELinux often uses regular expressions to specify labels that
203 match multiple files.
204
205 The following file types are defined for bluetooth:
206
207
208
209 bluetooth_conf_rw_t
210
211 - Set files with the bluetooth_conf_rw_t type, if you want to treat the
212 files as bluetooth conf read/write content.
213
214
215
216 bluetooth_conf_t
217
218 - Set files with the bluetooth_conf_t type, if you want to treat the
219 files as bluetooth configuration data, usually stored under the /etc
220 directory.
221
222
223
224 bluetooth_exec_t
225
226 - Set files with the bluetooth_exec_t type, if you want to transition
227 an executable to the bluetooth_t domain.
228
229
230 Paths:
231 /usr/bin/dund, /usr/bin/hidd, /usr/bin/pand, /usr/sbin/hcid,
232 /usr/sbin/sdpd, /usr/bin/rfcomm, /usr/sbin/hid2hci, /usr/sbin/hci‐
233 attach, /usr/sbin/bluetoothd, /usr/libexec/bluetooth/bluetoothd
234
235
236 bluetooth_helper_exec_t
237
238 - Set files with the bluetooth_helper_exec_t type, if you want to tran‐
239 sition an executable to the bluetooth_helper_t domain.
240
241
242
243 bluetooth_helper_tmp_t
244
245 - Set files with the bluetooth_helper_tmp_t type, if you want to store
246 bluetooth helper temporary files in the /tmp directories.
247
248
249
250 bluetooth_helper_tmpfs_t
251
252 - Set files with the bluetooth_helper_tmpfs_t type, if you want to
253 store bluetooth helper files on a tmpfs file system.
254
255
256
257 bluetooth_initrc_exec_t
258
259 - Set files with the bluetooth_initrc_exec_t type, if you want to tran‐
260 sition an executable to the bluetooth_initrc_t domain.
261
262
263 Paths:
264 /etc/rc.d/init.d/dund, /etc/rc.d/init.d/pand,
265 /etc/rc.d/init.d/bluetooth
266
267
268 bluetooth_lock_t
269
270 - Set files with the bluetooth_lock_t type, if you want to treat the
271 files as bluetooth lock data, stored under the /var/lock directory
272
273
274
275 bluetooth_tmp_t
276
277 - Set files with the bluetooth_tmp_t type, if you want to store blue‐
278 tooth temporary files in the /tmp directories.
279
280
281
282 bluetooth_unit_file_t
283
284 - Set files with the bluetooth_unit_file_t type, if you want to treat
285 the files as bluetooth unit content.
286
287
288
289 bluetooth_var_lib_t
290
291 - Set files with the bluetooth_var_lib_t type, if you want to store the
292 bluetooth files under the /var/lib directory.
293
294
295
296 bluetooth_var_run_t
297
298 - Set files with the bluetooth_var_run_t type, if you want to store the
299 bluetooth files under the /run or /var/run directory.
300
301
302 Paths:
303 /var/run/sdp, /var/run/bluetoothd_address
304
305
306 Note: File context can be temporarily modified with the chcon command.
307 If you want to permanently change the file context you need to use the
308 semanage fcontext command. This will modify the SELinux labeling data‐
309 base. You will need to use restorecon to apply the labels.
310
311
313 semanage fcontext can also be used to manipulate default file context
314 mappings.
315
316 semanage permissive can also be used to manipulate whether or not a
317 process type is permissive.
318
319 semanage module can also be used to enable/disable/install/remove pol‐
320 icy modules.
321
322 semanage boolean can also be used to manipulate the booleans
323
324
325 system-config-selinux is a GUI tool available to customize SELinux pol‐
326 icy settings.
327
328
330 This manual page was auto-generated using sepolicy manpage .
331
332
334 selinux(8), bluetooth(8), semanage(8), restorecon(8), chcon(1), sepol‐
335 icy(8), setsebool(8), bluetooth_helper_selinux(8), blue‐
336 tooth_helper_selinux(8)
337
338
339
340bluetooth 23-10-20 bluetooth_selinux(8)