[STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[Koen Kooi]

From: Koen Kooi <koen@openembedded.org>

* this makes bluetooth actually work for non-root users and when using ssh/vnc/etc
* this also overwrites the bluetooth.conf in the files/ that wasn't used anymore
* this also includes the fixup commit from .dev named "bluez4: fix dbus service file" 

Signed-off-by: Koen Kooi <koen@openembedded.org>
---
 recipes/bluez/bluez4_4.31.bb       |    5 ++++-
 recipes/bluez/files/bluetooth.conf |   29 ++++++++++++++++-------------
 2 files changed, 20 insertions(+), 14 deletions(-)

diff --git a/recipes/bluez/bluez4_4.31.bb b/recipes/bluez/bluez4_4.31.bb
index 15e8b00..8c2f656 100644
--- a/recipes/bluez/bluez4_4.31.bb
+++ b/recipes/bluez/bluez4_4.31.bb
@@ -4,12 +4,13 @@ PRIORITY = "optional"
 DEPENDS = "gst-plugins-base alsa-lib libusb-compat dbus-glib"
 HOMEPAGE = "http://www.bluez.org"
 LICENSE = "GPL"
-PR = "r4"
+PR = "r6"
 
 SRC_URI = "\
   http://www.kernel.org/pub/linux/bluetooth/bluez-${PV}.tar.gz \
   file://fix-dfutool-usb-declaration-mismatch.patch;patch=1 \
   file://sbc-thumb.patch;patch=1 \
+  file://bluetooth.conf \
 #  file://hid2hci_usb_init.patch;patch=1 \
 "
 S = "${WORKDIR}/bluez-${PV}"
@@ -43,6 +44,8 @@ do_install_append() {
         install -m 0644 ${S}/audio/audio.conf ${D}/${sysconfdir}/bluetooth/
         install -m 0644 ${S}/network/network.conf ${D}/${sysconfdir}/bluetooth/
         install -m 0644 ${S}/input/input.conf ${D}/${sysconfdir}/bluetooth/
+        # at_console doesn't really work with the current state of OE, so punch some more holes so people can actually use BT
+        install -m 0644 ${WORKDIR}/bluetooth.conf ${D}/${sysconfdir}/dbus-1/system.d/
 }
 
 PACKAGES =+ "gst-plugin-bluez libasound-module-bluez"
diff --git a/recipes/bluez/files/bluetooth.conf b/recipes/bluez/files/bluetooth.conf
index 8720847..ca5e9e4 100644
--- a/recipes/bluez/files/bluetooth.conf
+++ b/recipes/bluez/files/bluetooth.conf
@@ -1,13 +1,16 @@
-#
-# additional cards for /etc/pcmcia/bluetooth.conf
-# Note for OE: This file is _appended_ to the stock
-# bluetooth.conf in bluez-utils, so no need to duplicate
-# entries for individual cards.
-#
-card "CSR BT01x0M Bluetooth CF Card"
-  version "Bluetooth BT0100M", "", ""
-  bind "serial_cs" class "bluetooth"
-
-card "Socket Bluetooth CF Card Rev. G" 
-  manfid 0x0104, 0x0096 
-  bind "serial_cs" class "bluetooth"
+<!-- This configuration file specifies the required security policies
+     for Bluetooth core daemon to work. -->
+
+<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration 1.0//EN"
+ "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
+<busconfig>
+
+  <!-- ../system.conf have denied everything, so we just punch some holes -->
+
+  <policy context="default">
+    <allow own="org.bluez"/>
+    <allow send_destination="org.bluez"/>
+    <allow send_interface="org.bluez.Agent"/>
+  </policy>
+
+</busconfig>
-- 
1.5.6.5

Re: [STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[Koen Kooi]

On 09-04-09 12:04, Koen Kooi wrote:
> From: Koen Kooi<koen@openembedded.org>
>
> * this makes bluetooth actually work for non-root users and when using ssh/vnc/etc
> * this also overwrites the bluetooth.conf in the files/ that wasn't used anymore
> * this also includes the fixup commit from .dev named "bluez4: fix dbus service file"

ping

Re: [STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[Khem Raj]

Acked-by: Khem Raj <raj.khem@gmail.com>


oh the PR is jumping from 4 to 6. May be it should be 5 ?

On 4/9/09, Koen Kooi <k.kooi@student.utwente.nl> wrote:
> From: Koen Kooi <koen@openembedded.org>
>
> * this makes bluetooth actually work for non-root users and when using
> ssh/vnc/etc
> * this also overwrites the bluetooth.conf in the files/ that wasn't used
> anymore
> * this also includes the fixup commit from .dev named "bluez4: fix dbus
> service file"
>
> Signed-off-by: Koen Kooi <koen@openembedded.org>
> ---
>  recipes/bluez/bluez4_4.31.bb       |    5 ++++-
>  recipes/bluez/files/bluetooth.conf |   29 ++++++++++++++++-------------
>  2 files changed, 20 insertions(+), 14 deletions(-)
>
> diff --git a/recipes/bluez/bluez4_4.31.bb b/recipes/bluez/bluez4_4.31.bb
> index 15e8b00..8c2f656 100644
> --- a/recipes/bluez/bluez4_4.31.bb
> +++ b/recipes/bluez/bluez4_4.31.bb
> @@ -4,12 +4,13 @@ PRIORITY = "optional"
>  DEPENDS = "gst-plugins-base alsa-lib libusb-compat dbus-glib"
>  HOMEPAGE = "http://www.bluez.org"
>  LICENSE = "GPL"
> -PR = "r4"
> +PR = "r6"
>
>  SRC_URI = "\
>    http://www.kernel.org/pub/linux/bluetooth/bluez-${PV}.tar.gz \
>    file://fix-dfutool-usb-declaration-mismatch.patch;patch=1 \
>    file://sbc-thumb.patch;patch=1 \
> +  file://bluetooth.conf \
>  #  file://hid2hci_usb_init.patch;patch=1 \
>  "
>  S = "${WORKDIR}/bluez-${PV}"
> @@ -43,6 +44,8 @@ do_install_append() {
>          install -m 0644 ${S}/audio/audio.conf ${D}/${sysconfdir}/bluetooth/
>          install -m 0644 ${S}/network/network.conf
> ${D}/${sysconfdir}/bluetooth/
>          install -m 0644 ${S}/input/input.conf ${D}/${sysconfdir}/bluetooth/
> +        # at_console doesn't really work with the current state of OE, so
> punch some more holes so people can actually use BT
> +        install -m 0644 ${WORKDIR}/bluetooth.conf
> ${D}/${sysconfdir}/dbus-1/system.d/
>  }
>
>  PACKAGES =+ "gst-plugin-bluez libasound-module-bluez"
> diff --git a/recipes/bluez/files/bluetooth.conf
> b/recipes/bluez/files/bluetooth.conf
> index 8720847..ca5e9e4 100644
> --- a/recipes/bluez/files/bluetooth.conf
> +++ b/recipes/bluez/files/bluetooth.conf
> @@ -1,13 +1,16 @@
> -#
> -# additional cards for /etc/pcmcia/bluetooth.conf
> -# Note for OE: This file is _appended_ to the stock
> -# bluetooth.conf in bluez-utils, so no need to duplicate
> -# entries for individual cards.
> -#
> -card "CSR BT01x0M Bluetooth CF Card"
> -  version "Bluetooth BT0100M", "", ""
> -  bind "serial_cs" class "bluetooth"
> -
> -card "Socket Bluetooth CF Card Rev. G"
> -  manfid 0x0104, 0x0096
> -  bind "serial_cs" class "bluetooth"
> +<!-- This configuration file specifies the required security policies
> +     for Bluetooth core daemon to work. -->
> +
> +<!DOCTYPE busconfig PUBLIC "-//freedesktop//DTD D-BUS Bus Configuration
> 1.0//EN"
> + "http://www.freedesktop.org/standards/dbus/1.0/busconfig.dtd">
> +<busconfig>
> +
> +  <!-- ../system.conf have denied everything, so we just punch some holes
> -->
> +
> +  <policy context="default">
> +    <allow own="org.bluez"/>
> +    <allow send_destination="org.bluez"/>
> +    <allow send_interface="org.bluez.Agent"/>
> +  </policy>
> +
> +</busconfig>
> --
> 1.5.6.5
>
>
> _______________________________________________
> Openembedded-devel mailing list
> Openembedded-devel@lists.openembedded.org
> http://lists.linuxtogo.org/cgi-bin/mailman/listinfo/openembedded-devel
>

Re: [STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[Graeme Gregory]

Khem Raj wrote:
> Acked-by: Khem Raj <raj.khem@gmail.com>
>
>
> oh the PR is jumping from 4 to 6. May be it should be 5 ?
>
>   
I guess stuff merged from .dev should keep compatible PR numbers.
Otherwise it starts to get real painful to maintain.

Graeme

Re: [STABLE][PATCH] bluez4: add less restrictive (and hence less secure) bluetooth dbus config

[Koen Kooi]

On 12-04-09 17:06, Graeme Gregory wrote:
> Khem Raj wrote:
>> Acked-by: Khem Raj<raj.khem@gmail.com>
>>
>>
>> oh the PR is jumping from 4 to 6. May be it should be 5 ?
>>
>>
> I guess stuff merged from .dev should keep compatible PR numbers.
> Otherwise it starts to get real painful to maintain.

FWIW, the next bluez patch for .stable will consist of a few combined 
commits, so let's keep things in sync as much as possible.

regards,

Koen