[PATCH BlueZ v2 0/8] plugin/admin: Make allowlist adapter-scoped and enforce at runtime

["Frédéric Danis" <frederic.danis@collabora.com>]

This series tightens AdminPolicy ServiceAllowList handling and makes
its behavior consistent across adapter selection, adapter profile
activation, local SDP service registration, and device service
allowance checks.

The first part removes global AdminPolicy state and makes policy
tracking per-adapter, which fixes D-Bus updates being emitted on the
wrong adapter and avoids cross-adapter coupling.

The second part updates bluetoothctl admin.allow to be adapter-aware:
it now accepts an optional [ctrl] argument and otherwise targets the
currently selected default adapter. Documentation is updated
accordingly.

The core functional change is runtime enforcement of ServiceAllowList
for local adapter/server services in addition to existing remote-device
policy checks. When policy changes, adapters immediately reapply
allowlist decisions by stopping/removing disallowed services and
starting newly allowed ones, without restarting bluetoothd.

While exercising this runtime path, a UAF was found in audio media app
teardown when endpoint/player objects were destroyed before proxy
removal. The series fixes object/queue lifetime ownership to prevent
stale pointer dereferences.

Finally, device-side allowlist checks are switched to the same
profile-aware policy mapping used by adapter-side logic, so cases such
as A2DP role inversion are handled consistently.

Summary of effects:
- AdminPolicy state is correctly scoped per adapter.
- admin.allow can target explicit adapter or the selected default.
- ServiceAllowList now governs both remote profiles and local
  adapter/server services.
- Allowlist updates are enforced immediately on initialized adapters.
- Device and adapter policy decisions now use the same profile-aware
  UUID mapping semantics.
- Audio media teardown no longer risks UAF during runtime service
  reconfiguration.

v1->v2: Add new commit to fix outgoing connection by unifying device-side
 filtering with adapter-side profile-aware allowlist mapping semantics.

Frédéric Danis (8):
  plugins/admin: make AdminPolicy state per-adapter
  client/bluetoothctl: make admin.allow controller-aware
  doc: document admin.allow optional controller argument
  src/adapter: enforce allowlist for local services
  plugins/admin: reapply allowlist on policy updates
  doc: describe admin allowlist runtime enforcement
  profiles/audio: fix UAF on external media service teardown
  device: apply profile-aware admin allowlist checks for device services

 client/admin.c                      | 114 ++++++++++++++++++-----
 client/admin.h                      |   4 +
 client/main.c                       |  25 ++++-
 doc/bluetoothctl-admin.rst          |  13 ++-
 doc/org.bluez.AdminPolicySet.rst    |  12 +++
 doc/org.bluez.AdminPolicyStatus.rst |   5 +
 plugins/admin.c                     | 131 +++++++++++++++++++-------
 profiles/audio/media.c              |  16 ++++
 src/adapter.c                       | 139 ++++++++++++++++++++++++++++
 src/adapter.h                       |   4 +
 src/device.c                        |   5 +-
 11 files changed, 405 insertions(+), 63 deletions(-)

-- 
2.43.0