bluetoot..._selinux(8)

📦
version 20250627+git412.dbf877ab7 · 7 versions
, in opensuse-leap 16.0

💙 bluetoot..._selinux(8) — the SELinux glow-up for bluetooth_helper

ok bestie, so this is the manual page for bluetoot..._selinux(8), aka the SELinux policy page for bluetooth_helper. Yes the title got cut off mid-word, no we're not gonna talk about it, she's iconic anyway 💅

✨ NAME ✨

bluetooth_helper_selinux — the Security Enhanced Linux Policy for the bluetooth_helper processes 🫶

🌸 DESCRIPTION 🌸

Security-Enhanced Linux keeps the bluetooth_helper processes safe and sound via flexible mandatory access control. That's it, that's the vibe — SELinux is literally the bodyguard and it does not do vibes-based security.

So here's the tea: the bluetooth_helper processes run with the bluetooth_helper_t SELinux type. Wanna check if you've got these processes running? Just run the ps command with the -Z qualifier, like:

ps -eZ | grep bluetooth_helper_t

Slay. Now you can see all the contexts. ✨

🚪 ENTRYPOINTS 🚪

The bluetooth_helper_t SELinux type can be entered via the bluetooth_helper_exec_t file type — that's the doorway, no cap.

The default entrypoint paths for the bluetooth_helper_t domain are the following:

/usr/bin/blue.*pin

That's the whole list. One (1) regex. Main character energy. 👑

🧬 PROCESS TYPES 🧬

SELinux defines process types (domains) for each process running on the system. Whew, that's a mouthful — basically every process gets a little domain of its own.

You can see the context of a process using the -Z option to ps. Same trick as before, she's reliable.

Policy governs the access confined processes have to files. The SELinux bluetooth_helper policy is very flexible, allowing users to set up their bluetooth_helper processes in as secure a method as possible. 💖

The following process types are defined for bluetooth_helper:

  • bluetooth_helper_t
Note: semanage permissive -a bluetooth_helper_t can be used to make the process type bluetooth_helper_t permissive. Important, bestie: SELinux does not deny access to permissive process types, but the AVC (SELinux denials) messages are still generated. So like... she's not mad, she's just taking notes. 😭

🎚️ BOOLEANS 🎚️

SELinux policy is customizable based on least access required — the "give her nothing and watch her thrive" philosophy. The bluetooth_helper policy is extremely flexible and has several booleans that let you manipulate the policy and run bluetooth_helper with the tightest access possible. 🔥

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

If you want to allow system to run with NIS, you must turn on the nis_enabled boolean. Disabled by default.

setsebool -P nis_enabled 1

If you want to allow regular users direct dri device access, you must turn on the selinuxuser_direct_dri_enabled boolean. Disabled by default.

setsebool -P selinuxuser_direct_dri_enabled 1

If you want to allows clients to write to the X server shared memory segments, you must turn on the xserver_clients_write_xshm boolean. Disabled by default.

setsebool -P xserver_clients_write_xshm 1

(yes the original says "to allows", we're keeping her exactly as she is, she's perfect 💀)

📂 MANAGED FILES 📂

The SELinux process type bluetooth_helper_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Huge caveat though:

Note: the process's UID still needs to have DAC permissions. SELinux isn't gonna override your regular file permissions, bestie. ✋

So, the file types:

  • bluetooth_helper_tmp_t
  • bluetooth_helper_tmpfs_t
  • krb5_host_rcache_t
/var/tmp/krb5_0.rcache2
/var/cache/krb5rcache(/.*)?
/var/tmp/nfs_0
/var/tmp/DNS_25
/var/tmp/host_0
/var/tmp/imap_0
/var/tmp/HTTP_23
/var/tmp/HTTP_48
/var/tmp/ldap_55
/var/tmp/ldap_487
/var/tmp/ldapmap1_0
  • user_fonts_cache_t
/root/.fontconfig(/.*)?
/root/.fonts/auto(/.*)?
/root/.fonts.cache-.*
/root/.cache/fontconfig(/.*)?
/home/[^/]+/.fontconfig(/.*)?
/home/[^/]+/.fonts/auto(/.*)?
/home/[^/]+/.fonts.cache-.*
/home/[^/]+/.cache/fontconfig(/.*)?

Fonts! Caches! Kerberos rcache files! It's giving ecosystem. 🌈

🗂️ FILE CONTEXTS 🗂️

SELinux requires files to have an extended attribute to define the file type. That's how she knows who's who at the party.

You can see the context of a file using the -Z option to ls. (Yes, -Z again. She's everywhere. She's the moment.)

Policy governs the access confined processes have to these files. The SELinux bluetooth_helper policy is very flexible, allowing users to set up their bluetooth_helper processes in as secure a method as possible. 💜

⭐ STANDARD FILE CONTEXT ⭐

SELinux defines the file context types for the bluetooth_helper. If you wanted to store files with these types in a different paths, you need to execute the semanage command to specify alternate labeling and then use restorecon to put the labels on disk. Like so:

semanage fcontext -a -t bluetooth_helper_exec_t
'/srv/bluetooth_helper/content(/.*)?'
restorecon -R -v /srv/mybluetooth_helper_content
Note: SELinux often uses regular expressions to specify labels that match multiple files. So that (/.*)? is doing a lot of heavy lifting. Respect her. 🎀

The following file types are defined for bluetooth_helper:

  • bluetooth_helper_exec_t — set files with the bluetooth_helper_exec_t type if you want to transition an executable to the bluetooth_helper_t domain.
  • bluetooth_helper_tmp_t — set files with the bluetooth_helper_tmp_t type if you want to store bluetooth helper temporary files in the /tmp directories.
  • bluetooth_helper_tmpfs_t — set files with the bluetooth_helper_tmpfs_t type if you want to store bluetooth helper files on a tmpfs file system.
Note: file context can be temporarily modified with the chcon command. But if you want to permanently change the file context, you need to use the semanage fcontext command — this will modify the SELinux labeling database. And then you will need to use restorecon to apply the labels. Temporary = chcon, permanent = semanage fcontext + restorecon. Don't mix them up, iykyk. 🙈

🛠️ COMMANDS 🛠️

The greatest hits, all in one place:

  • semanage fcontext can also be used to manipulate default file context mappings.
  • semanage permissive can also be used to manipulate whether or not a process type is permissive.
  • semanage module can also be used to enable/disable/install/remove policy modules.
  • semanage boolean can also be used to manipulate the booleans.
  • system-config-selinux is a GUI tool available to customize SELinux policy settings. Yep, a whole GUI, for the girlies who prefer clicking to typing. 🖱️✨

👑 AUTHOR 👑

This manual page was auto-generated using sepolicy manpage. No human wrote this, she simply emerged, fully formed, like a butterfly. 🦋

🔗 SEE ALSO 🔗

selinux(8), bluetooth_helper(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8)

ok that's the whole page, bestie, you ate that 🍓 this gorgeous thing is bluetooth_helper, dated 26-10-06 — go forth and restorecon responsibly, mwah 💖

📦 where this page comes from