Bluez Utilities

Merge lp:~ssweeny/bluez/snappy-interface into lp:~bluetooth/bluez/snap-core-rolling

  1. snappy-interface
  2. Merge into snap-core-rolling
Proposed by Scott Sweeny
Status: Merged
Approved by: Simon Fels
Approved revision: 48
Merged at revision: 41
Proposed branch: lp:~ssweeny/bluez/snappy-interface
Merge into: lp:~bluetooth/bluez/snap-core-rolling
Prerequisite: lp:~morphis/bluez/fix-snapcraft-source
Diff against target: 1457 lines (+13/-1384)
6 files modified
bluez.apparmor (+0/-222)
bluez.seccomp (+0/-457)
obex.apparmor (+0/-225)
obex.seccomp (+0/-457)
parts/plugins/x-autotools.py (+3/-3)
snapcraft.yaml (+10/-20)
To merge this branch: bzr merge lp:~ssweeny/bluez/snappy-interface
Reviewer Review Type Date Requested Status
Simon Fels Approve
Tony Espy Pending
Bluetooth Pending
Review via email: mp+292304@code.launchpad.net

Commit message

Use the new bluez interface in ubuntu-core

Description of the change

This branch contains the updated snapcraft config to use the new bluez interface in ubuntu-core.

Tested against a fixes branch[1] that will hopefully soon be merged into ubuntu-core.

[1] https://github.com/ubuntu-core/snappy/pull/1037

To post a comment you must log in.
lp:~ssweeny/bluez/snappy-interface updated
47. By Scott Sweeny

Actually remove unused policy files

Revision history for this message
Simon Fels (morphis) wrote :

Left one naming related comment inline but otherwise LGTM

review: Needs Fixing
lp:~ssweeny/bluez/snappy-interface updated
48. By Scott Sweeny

Rename slot/plug to service/client respectively

Revision history for this message
Scott Sweeny (ssweeny) wrote :

> Left one naming related comment inline but otherwise LGTM

Well-spotted. Done.

Should this naming scheme be part of our guidelines doc?

Revision history for this message
Simon Fels (morphis) wrote :

@Scott: That would be awesome if you can add a chapter for a interface naming convention.

Revision history for this message
Simon Fels (morphis) :
review: Approve

Preview Diff

[H/L] Next/Prev Comment, [J/K] Next/Prev File, [N/P] Next/Prev Hunk
=== removed file 'bluez.apparmor'
--- bluez.apparmor 2016-02-01 18:56:49 +0000
+++ bluez.apparmor 1970-01-01 00:00:00 +0000
@@ -1,222 +0,0 @@
1#
2# AppArmor confinement for bluez's bluetoothd
3#
4
5#include <tunables/global>
6
7# Specified profile variables
8###VAR###
9
10###PROFILEATTACH### (attach_disconnected) {
11 #include <abstractions/base>
12 #include <abstractions/openssl>
13
14 # Explicitly deny ptrace for now since it can be abused to break out of the
15 # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
16 audit deny ptrace (trace),
17
18 # Explicitly deny mount, remount and umount
19 audit deny mount,
20 audit deny remount,
21 audit deny umount,
22
23 # Read-only for the install directory
24 @{CLICK_DIR}/@{APP_PKGNAME}/ r,
25 @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/ r,
26 @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/** mrklix,
27
28 # Read-only home area for other versions
29 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/ r,
30 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ r,
31 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** mrkix,
32
33 # Writable home area for this version.
34 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ w,
35 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
36
37 # Read-only system area for other versions
38 /var/lib/snaps/@{APP_PKGNAME}/ r,
39 /var/lib/snaps/@{APP_PKGNAME}/** mrkix,
40
41 # Writable system area only for this version
42 /var/lib/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ w,
43 /var/lib/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
44
45 # The ubuntu-core-launcher creates an app-specific private restricted /tmp
46 # and will fail to launch the app if something goes wrong. As such, we can
47 # simply allow full access to /tmp.
48 /tmp/ r,
49 /tmp/** mrwlkix,
50
51 # Miscellaneous accesses
52 /etc/mime.types r,
53 @{PROC}/ r,
54 /etc/{,writable/}hostname r,
55 /etc/{,writable/}localtime r,
56 /etc/{,writable/}timezone r,
57 @{PROC}/sys/kernel/hostname r,
58 @{PROC}/sys/kernel/osrelease r,
59 @{PROC}/sys/fs/file-max r,
60 @{PROC}/sys/kernel/pid_max r,
61 # this leaks interface names and stats, but not in a way that is traceable
62 # to the user/device
63 @{PROC}/net/dev r,
64
65 #
66 # Various accesses that may or may not be required for your framework.
67 # Adjust as necessary for your services.
68 #
69
70 # Shell (do not usually need abstractions/bash)
71 #include <abstractions/consoles>
72 /bin/bash ixr,
73 /bin/dash ixr,
74 /etc/bash.bashrc r,
75 /usr/share/terminfo/** r,
76 /etc/inputrc r,
77 deny @{HOME}/.inputrc r,
78 # Common utilities for shell scripts
79 /{,usr/}bin/{,g,m}awk ixr,
80 /{,usr/}bin/basename ixr,
81 /{,usr/}bin/bunzip2 ixr,
82 /{,usr/}bin/bzcat ixr,
83 /{,usr/}bin/bzdiff ixr,
84 /{,usr/}bin/bzgrep ixr,
85 /{,usr/}bin/bzip2 ixr,
86 /{,usr/}bin/cat ixr,
87 /{,usr/}bin/chmod ixr,
88 /{,usr/}bin/cmp ixr,
89 /{,usr/}bin/cp ixr,
90 /{,usr/}bin/cpio ixr,
91 /{,usr/}bin/cut ixr,
92 /{,usr/}bin/date ixr,
93 /{,usr/}bin/dd ixr,
94 /{,usr/}bin/diff{,3} ixr,
95 /{,usr/}bin/dir ixr,
96 /{,usr/}bin/dirname ixr,
97 /{,usr/}bin/echo ixr,
98 /{,usr/}bin/{,e,f,r}grep ixr,
99 /{,usr/}bin/env ixr,
100 /{,usr/}bin/expr ixr,
101 /{,usr/}bin/false ixr,
102 /{,usr/}bin/find ixr,
103 /{,usr/}bin/fmt ixr,
104 /{,usr/}bin/getopt ixr,
105 /{,usr/}bin/head ixr,
106 /{,usr/}bin/hostname ixr,
107 /{,usr/}bin/id ixr,
108 /{,usr/}bin/igawk ixr,
109 /{,usr/}bin/kill ixr,
110 /{,usr/}bin/ldd ixr,
111 /{,usr/}bin/ln ixr,
112 /{,usr/}bin/line ixr,
113 /{,usr/}bin/link ixr,
114 /{,usr/}bin/logger ixr,
115 /{,usr/}bin/ls ixr,
116 /{,usr/}bin/md5sum ixr,
117 /{,usr/}bin/mkdir ixr,
118 /{,usr/}bin/mktemp ixr,
119 /{,usr/}bin/mv ixr,
120 /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
121 /{,usr/}bin/pgrep ixr,
122 /{,usr/}bin/printenv ixr,
123 /{,usr/}bin/printf ixr,
124 /{,usr/}bin/ps ixr,
125 /{,usr/}bin/pwd ixr,
126 /{,usr/}bin/readlink ixr,
127 /{,usr/}bin/realpath ixr,
128 /{,usr/}bin/rev ixr,
129 /{,usr/}bin/rm ixr,
130 /{,usr/}bin/rmdir ixr,
131 /{,usr/}bin/sed ixr,
132 /{,usr/}bin/seq ixr,
133 /{,usr/}bin/sleep ixr,
134 /{,usr/}bin/sort ixr,
135 /{,usr/}bin/stat ixr,
136 /{,usr/}bin/tac ixr,
137 /{,usr/}bin/tail ixr,
138 /{,usr/}bin/tar ixr,
139 /{,usr/}bin/tee ixr,
140 /{,usr/}bin/test ixr,
141 /{,usr/}bin/tempfile ixr,
142 /{,usr/}bin/touch ixr,
143 /{,usr/}bin/tr ixr,
144 /{,usr/}bin/true ixr,
145 /{,usr/}bin/uname ixr,
146 /{,usr/}bin/uniq ixr,
147 /{,usr/}bin/unlink ixr,
148 /{,usr/}bin/unxz ixr,
149 /{,usr/}bin/unzip ixr,
150 /{,usr/}bin/vdir ixr,
151 /{,usr/}bin/wc ixr,
152 /{,usr/}bin/which ixr,
153 /{,usr/}bin/xargs ixr,
154 /{,usr/}bin/xz ixr,
155 /{,usr/}bin/yes ixr,
156 /{,usr/}bin/zcat ixr,
157 /{,usr/}bin/z{,e,f}grep ixr,
158 /{,usr/}bin/zip ixr,
159 /{,usr/}bin/zipgrep ixr,
160 /{,usr/}bin/uptime ixr,
161 @{PROC}/uptime r,
162 @{PROC}/loadavg r,
163
164 #
165 # Framework service/binary specific rules below here
166 #
167 network bluetooth,
168
169 capability net_admin,
170 capability net_bind_service,
171
172 # File accesses
173 /sys/bus/usb/drivers/btusb/ r,
174 /sys/bus/usb/drivers/btusb/** r,
175 /sys/class/bluetooth/ r,
176 /sys/devices/**/bluetooth/ rw,
177 /sys/devices/**/bluetooth/** rw,
178 /sys/devices/**/id/chassis_type r,
179
180 # TODO: use snappy hardware assignment for this once LP: #1498917 is fixed
181 /dev/rfkill rw,
182
183 # DBus accesses
184 #include <abstractions/dbus-strict>
185 dbus (send)
186 bus=system
187 path=/org/freedesktop/DBus
188 interface=org.freedesktop.DBus
189 member={Request,Release}Name
190 peer=(name=org.freedesktop.DBus),
191
192 dbus (send)
193 bus=system
194 path=/org/freedesktop/*
195 interface=org.freedesktop.DBus.Properties
196 peer=(label=unconfined),
197
198 # Allow binding the service to the requested connection name
199 dbus (bind)
200 bus=system
201 name="org.bluez",
202
203 # Allow traffic to/from our path and interface with any method
204 dbus (receive, send)
205 bus=system
206 path=/org/bluez{,/**}
207 interface=org.bluez.*,
208
209 # Allow traffic to/from org.freedesktop.DBus for bluez service
210 dbus (receive, send)
211 bus=system
212 path=/
213 interface=org.freedesktop.DBus.**,
214 dbus (receive, send)
215 bus=system
216 path=/org/bluez{,/**}
217 interface=org.freedesktop.DBus.**,
218
219 # Allow replacing our dbus policy configuration file until
220 # snappy has a better way to do this.
221 /etc/dbus-1/system.d/bluez_* rw,
222}
2230
=== removed file 'bluez.seccomp'
--- bluez.seccomp 2016-01-26 00:25:18 +0000
+++ bluez.seccomp 1970-01-01 00:00:00 +0000
@@ -1,457 +0,0 @@
1#
2# Seccomp policy for bluez
3#
4
5# Dangerous syscalls that we don't ever want to allow
6
7# kexec
8# EXPLICITLY DENY kexec_load
9
10# kernel modules
11# EXPLICITLY DENY create_module
12# EXPLICITLY DENY init_module
13# EXPLICITLY DENY finit_module
14# EXPLICITLY DENY delete_module
15
16# these have a history of vulnerabilities, are not widely used, and
17# open_by_handle_at has been used to break out of docker containers by brute
18# forcing the handle value: http://stealth.openwall.net/xSports/shocker.c
19# EXPLICITLY DENY name_to_handle_at
20# EXPLICITLY DENY open_by_handle_at
21
22# Explicitly deny ptrace since it can be abused to break out of the seccomp
23# sandbox
24# EXPLICITLY DENY ptrace
25
26# Explicitly deny capability mknod so apps can't create devices
27# EXPLICITLY DENY mknod
28# EXPLICITLY DENY mknodat
29
30# Explicitly deny (u)mount so apps can't change mounts in their namespace
31# EXPLICITLY DENY mount
32# EXPLICITLY DENY umount
33# EXPLICITLY DENY umount2
34
35# Explicitly deny kernel keyring access
36# EXPLICITLY DENY add_key
37# EXPLICITLY DENY keyctl
38# EXPLICITLY DENY request_key
39
40# end dangerous syscalls
41
42access
43faccessat
44
45alarm
46brk
47
48# ARM private syscalls
49breakpoint
50cacheflush
51set_tls
52usr26
53usr32
54
55capget
56
57chdir
58fchdir
59
60# We can't effectively block file perms due to open() with O_CREAT, so allow
61# chmod until we have syscall arg filtering (LP: #1446748)
62chmod
63fchmod
64fchmodat
65
66# snappy doesn't currently support per-app UID/GIDs so don't allow chown. To
67# properly support chown, we need to have syscall arg filtering (LP: #1446748)
68# and per-app UID/GIDs.
69#chown
70#chown32
71#fchown
72#fchown32
73#fchownat
74#lchown
75#lchown32
76
77clock_getres
78clock_gettime
79clock_nanosleep
80clone
81close
82creat
83dup
84dup2
85dup3
86epoll_create
87epoll_create1
88epoll_ctl
89epoll_ctl_old
90epoll_pwait
91epoll_wait
92epoll_wait_old
93eventfd
94eventfd2
95execve
96execveat
97_exit
98exit
99exit_group
100fallocate
101
102# requires CAP_SYS_ADMIN
103#fanotify_init
104#fanotify_mark
105
106fcntl
107fcntl64
108flock
109fork
110ftime
111futex
112get_mempolicy
113get_robust_list
114get_thread_area
115getcpu
116getcwd
117getdents
118getdents64
119getegid
120getegid32
121geteuid
122geteuid32
123getgid
124getgid32
125getgroups
126getgroups32
127getitimer
128getpgid
129getpgrp
130getpid
131getppid
132getpriority
133getrandom
134getresgid
135getresgid32
136getresuid
137getresuid32
138
139getrlimit
140ugetrlimit
141
142getrusage
143getsid
144gettid
145gettimeofday
146getuid
147getuid32
148
149getxattr
150fgetxattr
151lgetxattr
152
153inotify_add_watch
154inotify_init
155inotify_init1
156inotify_rm_watch
157
158# Needed by shell
159ioctl
160
161io_cancel
162io_destroy
163io_getevents
164io_setup
165io_submit
166ioprio_get
167# affects other processes, requires CAP_SYS_ADMIN. Potentially allow with
168# syscall filtering of (at least) IOPRIO_WHO_USER (LP: #1446748)
169#ioprio_set
170
171ipc
172kill
173link
174linkat
175
176listxattr
177llistxattr
178flistxattr
179
180lseek
181llseek
182_llseek
183lstat
184lstat64
185
186madvise
187fadvise64
188fadvise64_64
189arm_fadvise64_64
190
191mbind
192mincore
193mkdir
194mkdirat
195mlock
196mlockall
197mmap
198mmap2
199mprotect
200
201# LP: #1448184 - these aren't currently mediated by AppArmor. Deny for now
202#mq_getsetattr
203#mq_notify
204#mq_open
205#mq_timedreceive
206#mq_timedsend
207#mq_unlink
208
209mremap
210msgctl
211msgget
212msgrcv
213msgsnd
214msync
215munlock
216munlockall
217munmap
218
219nanosleep
220
221# LP: #1446748 - deny until we have syscall arg filtering. Alternatively, set
222# RLIMIT_NICE hard limit for apps, launch them under an appropriate nice value
223# and allow this call
224#nice
225
226# LP: #1446748 - support syscall arg filtering for mode_t with O_CREAT
227open
228
229openat
230pause
231pipe
232pipe2
233poll
234ppoll
235
236# LP: #1446748 - support syscall arg filtering
237prctl
238arch_prctl
239
240read
241pread
242pread64
243preadv
244readv
245
246readahead
247readdir
248readlink
249readlinkat
250remap_file_pages
251
252removexattr
253fremovexattr
254lremovexattr
255
256rename
257renameat
258renameat2
259
260# The man page says this shouldn't be needed, but we've seen denials for it
261# in the wild
262restart_syscall
263
264rmdir
265rt_sigaction
266rt_sigpending
267rt_sigprocmask
268rt_sigqueueinfo
269rt_sigreturn
270rt_sigsuspend
271rt_sigtimedwait
272rt_tgsigqueueinfo
273sched_getaffinity
274sched_getattr
275sched_getparam
276sched_get_priority_max
277sched_get_priority_min
278sched_getscheduler
279sched_rr_get_interval
280# LP: #1446748 - when support syscall arg filtering, enforce pid_t is 0 so the
281# app may only change its own scheduler
282sched_setscheduler
283
284sched_yield
285
286select
287_newselect
288pselect
289pselect6
290
291semctl
292semget
293semop
294semtimedop
295sendfile
296sendfile64
297
298# snappy doesn't currently support per-app UID/GIDs so don't allow this family
299# of syscalls. To properly support these, we need to have syscall arg filtering
300# (LP: #1446748) and per-app UID/GIDs.
301#setgid
302#setgid32
303#setgroups
304#setgroups32
305#setregid
306#setregid32
307#setresgid
308#setresgid32
309#setresuid
310#setresuid32
311#setreuid
312#setreuid32
313#setuid
314#setuid32
315
316# These break isolation but are common and can't be mediated at the seccomp
317# level with arg filtering
318setpgid
319setpgrp
320
321set_thread_area
322setitimer
323
324# apps don't have CAP_SYS_RESOURCE so these can't be abused to raise the hard
325# limits
326setrlimit
327prlimit64
328
329set_mempolicy
330set_robust_list
331setsid
332set_tid_address
333
334setxattr
335fsetxattr
336lsetxattr
337
338shmat
339shmctl
340shmdt
341shmget
342signal
343sigaction
344signalfd
345signalfd4
346sigaltstack
347sigpending
348sigprocmask
349sigreturn
350sigsuspend
351sigtimedwait
352sigwaitinfo
353
354# Per man page, on Linux this is limited to only AF_UNIX so it is ok to have
355# in the default template
356socketpair
357
358splice
359
360stat
361stat64
362fstat
363fstat64
364fstatat64
365lstat
366newfstatat
367oldfstat
368oldlstat
369oldstat
370
371statfs
372statfs64
373fstatfs
374fstatfs64
375statvfs
376fstatvfs
377ustat
378
379symlink
380symlinkat
381
382sync
383sync_file_range
384sync_file_range2
385arm_sync_file_range
386fdatasync
387fsync
388syncfs
389sysinfo
390syslog
391tee
392tgkill
393time
394timer_create
395timer_delete
396timer_getoverrun
397timer_gettime
398timer_settime
399timerfd_create
400timerfd_gettime
401timerfd_settime
402times
403tkill
404
405truncate
406truncate64
407ftruncate
408ftruncate64
409
410umask
411
412uname
413olduname
414oldolduname
415
416unlink
417unlinkat
418
419utime
420utimensat
421utimes
422futimesat
423
424vfork
425vmsplice
426wait4
427oldwait4
428waitpid
429waitid
430
431write
432writev
433pwrite
434pwrite64
435pwritev
436
437# Can communicate with DBus system service
438accept
439accept4
440bind
441connect
442getpeername
443getsockname
444getsockopt
445listen
446recv
447recvfrom
448recvmmsg
449recvmsg
450send
451sendmmsg
452sendmsg
453sendto
454setsockopt
455shutdown
456socketpair
457socket
4580
=== removed file 'obex.apparmor'
--- obex.apparmor 2016-02-01 18:56:32 +0000
+++ obex.apparmor 1970-01-01 00:00:00 +0000
@@ -1,225 +0,0 @@
1#
2# AppArmor confinement for bluez obexd
3#
4
5#include <tunables/global>
6
7# Specified profile variables
8###VAR###
9
10###PROFILEATTACH### (attach_disconnected) {
11 #include <abstractions/base>
12 #include <abstractions/nameservice>
13 #include <abstractions/openssl>
14
15 # Explicitly deny ptrace for now since it can be abused to break out of the
16 # seccomp sandbox. https://lkml.org/lkml/2015/3/18/823
17 audit deny ptrace (trace),
18
19 # Explicitly deny mount, remount and umount
20 audit deny mount,
21 audit deny remount,
22 audit deny umount,
23
24 # Read-only for the install directory
25 @{CLICK_DIR}/@{APP_PKGNAME}/ r,
26 @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/ r,
27 @{CLICK_DIR}/@{APP_PKGNAME}/@{APP_VERSION}/** mrklix,
28
29 # Read-only home area for other versions
30 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/ r,
31 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ r,
32 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** mrkix,
33
34 # Writable home area for this version.
35 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ w,
36 owner @{HOMEDIRS}/*/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
37
38 # Read-only system area for other versions
39 /var/lib/snaps/@{APP_PKGNAME}/ r,
40 /var/lib/snaps/@{APP_PKGNAME}/** mrkix,
41
42 # Writable system area only for this version
43 /var/lib/snaps/@{APP_PKGNAME}/@{APP_VERSION}/ w,
44 /var/lib/snaps/@{APP_PKGNAME}/@{APP_VERSION}/** wl,
45
46 # The ubuntu-core-launcher creates an app-specific private restricted /tmp
47 # and will fail to launch the app if something goes wrong. As such, we can
48 # simply allow full access to /tmp.
49 /tmp/ r,
50 /tmp/** mrwlkix,
51
52 # Miscellaneous accesses
53 /etc/mime.types r,
54 @{PROC}/ r,
55 /etc/{,writable/}hostname r,
56 /etc/{,writable/}localtime r,
57 /etc/{,writable/}timezone r,
58 @{PROC}/sys/kernel/hostname r,
59 @{PROC}/sys/kernel/osrelease r,
60 @{PROC}/sys/fs/file-max r,
61 @{PROC}/sys/kernel/pid_max r,
62 # this leaks interface names and stats, but not in a way that is traceable
63 # to the user/device
64 @{PROC}/net/dev r,
65
66 #
67 # Various accesses that may or may not be required for your framework.
68 # Adjust as necessary for your services.
69 #
70
71 # Shell (do not usually need abstractions/bash)
72 #include <abstractions/consoles>
73 /bin/bash ixr,
74 /bin/dash ixr,
75 /etc/bash.bashrc r,
76 /usr/share/terminfo/** r,
77 /etc/inputrc r,
78 deny @{HOME}/.inputrc r,
79 # Common utilities for shell scripts
80 /{,usr/}bin/{,g,m}awk ixr,
81 /{,usr/}bin/basename ixr,
82 /{,usr/}bin/bunzip2 ixr,
83 /{,usr/}bin/bzcat ixr,
84 /{,usr/}bin/bzdiff ixr,
85 /{,usr/}bin/bzgrep ixr,
86 /{,usr/}bin/bzip2 ixr,
87 /{,usr/}bin/cat ixr,
88 /{,usr/}bin/chmod ixr,
89 /{,usr/}bin/cmp ixr,
90 /{,usr/}bin/cp ixr,
91 /{,usr/}bin/cpio ixr,
92 /{,usr/}bin/cut ixr,
93 /{,usr/}bin/date ixr,
94 /{,usr/}bin/dd ixr,
95 /{,usr/}bin/diff{,3} ixr,
96 /{,usr/}bin/dir ixr,
97 /{,usr/}bin/dirname ixr,
98 /{,usr/}bin/echo ixr,
99 /{,usr/}bin/{,e,f,r}grep ixr,
100 /{,usr/}bin/env ixr,
101 /{,usr/}bin/expr ixr,
102 /{,usr/}bin/false ixr,
103 /{,usr/}bin/find ixr,
104 /{,usr/}bin/fmt ixr,
105 /{,usr/}bin/getopt ixr,
106 /{,usr/}bin/head ixr,
107 /{,usr/}bin/hostname ixr,
108 /{,usr/}bin/id ixr,
109 /{,usr/}bin/igawk ixr,
110 /{,usr/}bin/kill ixr,
111 /{,usr/}bin/ldd ixr,
112 /{,usr/}bin/ln ixr,
113 /{,usr/}bin/line ixr,
114 /{,usr/}bin/link ixr,
115 /{,usr/}bin/logger ixr,
116 /{,usr/}bin/ls ixr,
117 /{,usr/}bin/md5sum ixr,
118 /{,usr/}bin/mkdir ixr,
119 /{,usr/}bin/mktemp ixr,
120 /{,usr/}bin/mv ixr,
121 /{,usr/}bin/openssl ixr, # may cause harmless capability block_suspend denial
122 /{,usr/}bin/pgrep ixr,
123 /{,usr/}bin/printenv ixr,
124 /{,usr/}bin/printf ixr,
125 /{,usr/}bin/ps ixr,
126 /{,usr/}bin/pwd ixr,
127 /{,usr/}bin/readlink ixr,
128 /{,usr/}bin/realpath ixr,
129 /{,usr/}bin/rev ixr,
130 /{,usr/}bin/rm ixr,
131 /{,usr/}bin/rmdir ixr,
132 /{,usr/}bin/sed ixr,
133 /{,usr/}bin/seq ixr,
134 /{,usr/}bin/sleep ixr,
135 /{,usr/}bin/sort ixr,
136 /{,usr/}bin/stat ixr,
137 /{,usr/}bin/tac ixr,
138 /{,usr/}bin/tail ixr,
139 /{,usr/}bin/tar ixr,
140 /{,usr/}bin/tee ixr,
141 /{,usr/}bin/test ixr,
142 /{,usr/}bin/tempfile ixr,
143 /{,usr/}bin/touch ixr,
144 /{,usr/}bin/tr ixr,
145 /{,usr/}bin/true ixr,
146 /{,usr/}bin/uname ixr,
147 /{,usr/}bin/uniq ixr,
148 /{,usr/}bin/unlink ixr,
149 /{,usr/}bin/unxz ixr,
150 /{,usr/}bin/unzip ixr,
151 /{,usr/}bin/vdir ixr,
152 /{,usr/}bin/wc ixr,
153 /{,usr/}bin/which ixr,
154 /{,usr/}bin/xargs ixr,
155 /{,usr/}bin/xz ixr,
156 /{,usr/}bin/yes ixr,
157 /{,usr/}bin/zcat ixr,
158 /{,usr/}bin/z{,e,f}grep ixr,
159 /{,usr/}bin/zip ixr,
160 /{,usr/}bin/zipgrep ixr,
161 /{,usr/}bin/uptime ixr,
162 @{PROC}/uptime r,
163 @{PROC}/loadavg r,
164
165 #
166 # Framework service/binary specific rules below here
167 #
168 network bluetooth,
169
170 capability net_admin,
171 capability net_bind_service,
172
173 # File accesses
174 /sys/bus/usb/drivers/btusb/ r,
175 /sys/bus/usb/drivers/btusb/** r,
176 /sys/class/bluetooth/ r,
177 /sys/devices/**/bluetooth/ rw,
178 /sys/devices/**/bluetooth/** rw,
179 /sys/devices/**/id/chassis_type r,
180
181 # TODO: use snappy hardware assignment for this once LP: #1498917 is fixed
182 /dev/rfkill rw,
183
184 # DBus accesses
185 #include <abstractions/dbus-strict>
186 dbus (send)
187 bus=system
188 path=/org/freedesktop/DBus
189 interface=org.freedesktop.DBus
190 member={Request,Release}Name
191 peer=(name=org.freedesktop.DBus),
192
193 dbus (send)
194 bus=system
195 path=/org/freedesktop/*
196 interface=org.freedesktop.DBus.Properties
197 peer=(label=unconfined),
198
199 dbus (send)
200 bus=system
201 path=/org/freedesktop/*
202 interface=org.freedesktop.DBus.ObjectManager
203 peer=(label=unconfined),
204
205 # Allow binding the service to the requested connection name
206 dbus (bind)
207 bus=system
208 name="org.bluez.obex",
209
210 # Allow traffic to/from our path and interface with any method
211 dbus (receive, send)
212 bus=system
213 path=/org/bluez{,/**}
214 interface=org.bluez.*,
215
216 # Allow traffic to/from org.freedesktop.DBus for bluez service
217 dbus (receive, send)
218 bus=system
219 path=/
220 interface=org.freedesktop.DBus.**,
221 dbus (receive, send)
222 bus=system
223 path=/org/bluez{,/**}
224 interface=org.freedesktop.DBus.**,
225}
2260
=== removed file 'obex.seccomp'
--- obex.seccomp 2016-01-28 01:28:49 +0000
+++ obex.seccomp 1970-01-01 00:00:00 +0000
@@ -1,457 +0,0 @@
1#
2# Seccomp policy for bluez
3#
4
5# Dangerous syscalls that we don't ever want to allow
6
7# kexec
8# EXPLICITLY DENY kexec_load
9
10# kernel modules
11# EXPLICITLY DENY create_module
12# EXPLICITLY DENY init_module
13# EXPLICITLY DENY finit_module
14# EXPLICITLY DENY delete_module
15
16# these have a history of vulnerabilities, are not widely used, and
17# open_by_handle_at has been used to break out of docker containers by brute
18# forcing the handle value: http://stealth.openwall.net/xSports/shocker.c
19# EXPLICITLY DENY name_to_handle_at
20# EXPLICITLY DENY open_by_handle_at
21
22# Explicitly deny ptrace since it can be abused to break out of the seccomp
23# sandbox
24# EXPLICITLY DENY ptrace
25
26# Explicitly deny capability mknod so apps can't create devices
27# EXPLICITLY DENY mknod
28# EXPLICITLY DENY mknodat
29
30# Explicitly deny (u)mount so apps can't change mounts in their namespace
31# EXPLICITLY DENY mount
32# EXPLICITLY DENY umount
33# EXPLICITLY DENY umount2
34
35# Explicitly deny kernel keyring access
36# EXPLICITLY DENY add_key
37# EXPLICITLY DENY keyctl
38# EXPLICITLY DENY request_key
39
40# end dangerous syscalls
41
42access
43faccessat
44
45alarm
46brk
47
48# ARM private syscalls
49breakpoint
50cacheflush
51set_tls
52usr26
53usr32
54
55capget
56
57chdir
58fchdir
59
60# We can't effectively block file perms due to open() with O_CREAT, so allow
61# chmod until we have syscall arg filtering (LP: #1446748)
62chmod
63fchmod
64fchmodat
65
66# snappy doesn't currently support per-app UID/GIDs so don't allow chown. To
67# properly support chown, we need to have syscall arg filtering (LP: #1446748)
68# and per-app UID/GIDs.
69#chown
70#chown32
71#fchown
72#fchown32
73#fchownat
74#lchown
75#lchown32
76
77clock_getres
78clock_gettime
79clock_nanosleep
80clone
81close
82creat
83dup
84dup2
85dup3
86epoll_create
87epoll_create1
88epoll_ctl
89epoll_ctl_old
90epoll_pwait
91epoll_wait
92epoll_wait_old
93eventfd
94eventfd2
95execve
96execveat
97_exit
98exit
99exit_group
100fallocate
101
102# requires CAP_SYS_ADMIN
103#fanotify_init
104#fanotify_mark
105
106fcntl
107fcntl64
108flock
109fork
110ftime
111futex
112get_mempolicy
113get_robust_list
114get_thread_area
115getcpu
116getcwd
117getdents
118getdents64
119getegid
120getegid32
121geteuid
122geteuid32
123getgid
124getgid32
125getgroups
126getgroups32
127getitimer
128getpgid
129getpgrp
130getpid
131getppid
132getpriority
133getrandom
134getresgid
135getresgid32
136getresuid
137getresuid32
138
139getrlimit
140ugetrlimit
141
142getrusage
143getsid
144gettid
145gettimeofday
146getuid
147getuid32
148
149getxattr
150fgetxattr
151lgetxattr
152
153inotify_add_watch
154inotify_init
155inotify_init1
156inotify_rm_watch
157
158# Needed by shell
159ioctl
160
161io_cancel
162io_destroy
163io_getevents
164io_setup
165io_submit
166ioprio_get
167# affects other processes, requires CAP_SYS_ADMIN. Potentially allow with
168# syscall filtering of (at least) IOPRIO_WHO_USER (LP: #1446748)
169#ioprio_set
170
171ipc
172kill
173link
174linkat
175
176listxattr
177llistxattr
178flistxattr
179
180lseek
181llseek
182_llseek
183lstat
184lstat64
185
186madvise
187fadvise64
188fadvise64_64
189arm_fadvise64_64
190
191mbind
192mincore
193mkdir
194mkdirat
195mlock
196mlockall
197mmap
198mmap2
199mprotect
200
201# LP: #1448184 - these aren't currently mediated by AppArmor. Deny for now
202#mq_getsetattr
203#mq_notify
204#mq_open
205#mq_timedreceive
206#mq_timedsend
207#mq_unlink
208
209mremap
210msgctl
211msgget
212msgrcv
213msgsnd
214msync
215munlock
216munlockall
217munmap
218
219nanosleep
220
221# LP: #1446748 - deny until we have syscall arg filtering. Alternatively, set
222# RLIMIT_NICE hard limit for apps, launch them under an appropriate nice value
223# and allow this call
224#nice
225
226# LP: #1446748 - support syscall arg filtering for mode_t with O_CREAT
227open
228
229openat
230pause
231pipe
232pipe2
233poll
234ppoll
235
236# LP: #1446748 - support syscall arg filtering
237prctl
238arch_prctl
239
240read
241pread
242pread64
243preadv
244readv
245
246readahead
247readdir
248readlink
249readlinkat
250remap_file_pages
251
252removexattr
253fremovexattr
254lremovexattr
255
256rename
257renameat
258renameat2
259
260# The man page says this shouldn't be needed, but we've seen denials for it
261# in the wild
262restart_syscall
263
264rmdir
265rt_sigaction
266rt_sigpending
267rt_sigprocmask
268rt_sigqueueinfo
269rt_sigreturn
270rt_sigsuspend
271rt_sigtimedwait
272rt_tgsigqueueinfo
273sched_getaffinity
274sched_getattr
275sched_getparam
276sched_get_priority_max
277sched_get_priority_min
278sched_getscheduler
279sched_rr_get_interval
280# LP: #1446748 - when support syscall arg filtering, enforce pid_t is 0 so the
281# app may only change its own scheduler
282sched_setscheduler
283
284sched_yield
285
286select
287_newselect
288pselect
289pselect6
290
291semctl
292semget
293semop
294semtimedop
295sendfile
296sendfile64
297
298# snappy doesn't currently support per-app UID/GIDs so don't allow this family
299# of syscalls. To properly support these, we need to have syscall arg filtering
300# (LP: #1446748) and per-app UID/GIDs.
301#setgid
302#setgid32
303#setgroups
304#setgroups32
305#setregid
306#setregid32
307#setresgid
308#setresgid32
309#setresuid
310#setresuid32
311#setreuid
312#setreuid32
313#setuid
314#setuid32
315
316# These break isolation but are common and can't be mediated at the seccomp
317# level with arg filtering
318setpgid
319setpgrp
320
321set_thread_area
322setitimer
323
324# apps don't have CAP_SYS_RESOURCE so these can't be abused to raise the hard
325# limits
326setrlimit
327prlimit64
328
329set_mempolicy
330set_robust_list
331setsid
332set_tid_address
333
334setxattr
335fsetxattr
336lsetxattr
337
338shmat
339shmctl
340shmdt
341shmget
342signal
343sigaction
344signalfd
345signalfd4
346sigaltstack
347sigpending
348sigprocmask
349sigreturn
350sigsuspend
351sigtimedwait
352sigwaitinfo
353
354# Per man page, on Linux this is limited to only AF_UNIX so it is ok to have
355# in the default template
356socketpair
357
358splice
359
360stat
361stat64
362fstat
363fstat64
364fstatat64
365lstat
366newfstatat
367oldfstat
368oldlstat
369oldstat
370
371statfs
372statfs64
373fstatfs
374fstatfs64
375statvfs
376fstatvfs
377ustat
378
379symlink
380symlinkat
381
382sync
383sync_file_range
384sync_file_range2
385arm_sync_file_range
386fdatasync
387fsync
388syncfs
389sysinfo
390syslog
391tee
392tgkill
393time
394timer_create
395timer_delete
396timer_getoverrun
397timer_gettime
398timer_settime
399timerfd_create
400timerfd_gettime
401timerfd_settime
402times
403tkill
404
405truncate
406truncate64
407ftruncate
408ftruncate64
409
410umask
411
412uname
413olduname
414oldolduname
415
416unlink
417unlinkat
418
419utime
420utimensat
421utimes
422futimesat
423
424vfork
425vmsplice
426wait4
427oldwait4
428waitpid
429waitid
430
431write
432writev
433pwrite
434pwrite64
435pwritev
436
437# Can communicate with DBus system service
438accept
439accept4
440bind
441connect
442getpeername
443getsockname
444getsockopt
445listen
446recv
447recvfrom
448recvmmsg
449recvmsg
450send
451sendmmsg
452sendmsg
453sendto
454setsockopt
455shutdown
456socketpair
457socket
4580
=== modified file 'parts/plugins/x-autotools.py'
--- parts/plugins/x-autotools.py 2016-04-20 17:42:41 +0000
+++ parts/plugins/x-autotools.py 2016-04-20 17:42:41 +0000
@@ -72,8 +72,8 @@
7272
73 return schema73 return schema
7474
75 def __init__(self, name, options):75 def __init__(self, name, options, project):
76 super().__init__(name, options)76 super().__init__(name, options, project)
77 self.build_packages.extend([77 self.build_packages.extend([
78 'autoconf',78 'autoconf',
79 'automake',79 'automake',
@@ -126,5 +126,5 @@
126126
127 self.run(configure_command + self.options.configflags)127 self.run(configure_command + self.options.configflags)
128 self.run(['make', '-j{}'.format(128 self.run(['make', '-j{}'.format(
129 snapcraft.common.get_parallel_build_count())])129 self.project.parallel_build_count)])
130 self.run(make_install_command)130 self.run(make_install_command)
131131
=== modified file 'snapcraft.yaml'
--- snapcraft.yaml 2016-04-20 17:42:41 +0000
+++ snapcraft.yaml 2016-04-20 17:42:41 +0000
@@ -9,32 +9,24 @@
9apps:9apps:
10 bluetoothctl:10 bluetoothctl:
11 command: usr/bin/bluetoothctl11 command: usr/bin/bluetoothctl
12 uses: [bluez-client]12 plugs: [client]
13 obexctl:13 obexctl:
14 command: usr/bin/obexctl14 command: usr/bin/obexctl
15 uses: [bluez-client]15 plugs: [client]
16 bluez:16 bluez:
17 command: "usr/lib/bluetooth/bluetoothd -E"17 command: "usr/lib/bluetooth/bluetoothd -E"
18 daemon: simple18 daemon: simple
19 uses: [bluez-service]19 slots: [service]
20 obex:20 obex:
21 command: "usr/lib/bluetooth/obexd"21 command: "usr/lib/bluetooth/obexd"
22 daemon: simple22 daemon: simple
23 uses: [obex-service]23 slots: [service]
24uses:24plugs:
25 bluez-client:25 client:
26 type: migration-skill26 interface: bluez
27 caps: [bluez_client]27slots:
28 bluez-service:28 service:
29 type: migration-skill29 interface: bluez
30 security-policy:
31 apparmor: bluez.apparmor
32 seccomp: bluez.seccomp
33 obex-service:
34 type: migration-skill
35 security-policy:
36 apparmor: obex.apparmor
37 seccomp: obex.seccomp
3830
39parts:31parts:
40 bluez:32 bluez:
@@ -74,7 +66,5 @@
74 dbus-configuration:66 dbus-configuration:
75 plugin: copy67 plugin: copy
76 files: 68 files:
77 conf/bluez-dbus.conf: conf/bluez-dbus.conf
78 meta/framework-policy: meta/framework-policy
79 copyright: usr/share/doc/bluez/copyright69 copyright: usr/share/doc/bluez/copyright
80 doc/overview.md: usr/share/doc/bluez/overview.md70 doc/overview.md: usr/share/doc/bluez/overview.md

Subscribers

People subscribed via source and target branches

to all changes: