[PATCH BlueZ v3 0/7] plugin/admin: Make allowlist adapter-scoped and enforce at runtime

["Frédéric Danis" <frederic.danis@collabora.com>]

This series tightens AdminPolicy ServiceAllowList handling and makes
its behavior consistent across adapter selection, adapter profile
activation, local SDP service registration, and device service
allowance checks.

The first part removes global AdminPolicy state and makes policy
tracking per-adapter, which fixes D-Bus updates being emitted on the
wrong adapter and avoids cross-adapter coupling.

The second part updates bluetoothctl admin.allow to be adapter-aware:
it now targets the currently selected default adapter instead of a
single global proxy.

The core functional change is runtime enforcement of ServiceAllowList
for local adapter/server services in addition to existing remote-device
policy checks. When policy changes, adapters immediately reapply
allowlist decisions by stopping/removing disallowed services and
starting newly allowed ones, without restarting bluetoothd.

Finally, device-side and A2DP allowlist checks are made role-aware, so
that local Sink/Source role UUIDs are used consistently across
adapter profile probing, device connection filtering, and A2DP SEP
negotiation, fixing role-inverted cases and blocking disallowed roles
earlier (at Get_Capability/Set_Configuration time) instead of relying
on later teardown paths.

Summary of effects:
- AdminPolicy state is correctly scoped per adapter.
- admin.allow targets the currently selected default adapter.
- ServiceAllowList now governs both remote profiles and local
  adapter/server services.
- Allowlist updates are enforced immediately on initialized adapters.
- Device, adapter, and A2DP policy decisions consistently use
  role-aware UUID mapping semantics.
- Blocked A2DP roles are rejected at SEP negotiation time, avoiding
  stale role state and reconnect instability across policy updates.

v1->v2: Add new commit to fix outgoing connection by unifying device-side
 filtering with adapter-side profile-aware allowlist mapping semantics.

v2->v3:
- Drop the "profiles/audio: fix UAF on external media service
  teardown" commit, since it has already been merged upstream
  separately and is no longer part of this series.
- Drop the optional [ctrl] argument from bluetoothctl's admin.allow;
  it now always targets the currently selected default adapter, which
  also removed the need for the separate doc patch documenting that
  argument.
- src/adapter: map both a2dp-source and a2dp-sink profile probing to
  ADVANCED_AUDIO_UUID (0x110d) instead of swapped Sink/Source UUIDs,
  so profile probe gating matches the A2DP profile class while local
  Source/Sink SDP records still get filtered by their own UUIDs.
- device: rework device-side service allowance to use a dedicated
  role-aware helper (service_policy_uuid()) mapping a2dp-sink to the
  A2DP Source UUID and a2dp-source to the A2DP Sink UUID, instead of
  the shared btd_adapter_is_profile_allowed() helper, fixing a false
  block seen during host-initiated A2DP connect attempts.
- Add a new commit making A2DP allowlist enforcement itself role-safe:
  policy is now checked at Get_Capability/Set_Configuration
  negotiation time (rejecting blocked roles early), a2dp.c server
  role bookkeeping was hardened (explicit source_enabled/sink_enabled
  flags, cleared source/sink list heads) to avoid stale role state
  across dynamic reapply, and media.c now treats endpoints skipped by
  admin allowlist as non-fatal instead of logging an error.

Frédéric Danis (7):
  plugins/admin: make AdminPolicy state per-adapter
  client/bluetoothctl: make admin.allow controller-aware
  src/adapter: enforce allowlist for local services
  plugins/admin: reapply allowlist on policy updates
  doc: describe admin allowlist runtime enforcement
  device: unify admin allowlist checks for device services
  profiles/audio: make A2DP admin allowlist enforcement role-safe

 client/admin.c                      |  74 +++++++++++----
 client/admin.h                      |   2 +
 client/main.c                       |   8 ++
 doc/org.bluez.AdminPolicySet.rst    |  11 +++
 doc/org.bluez.AdminPolicyStatus.rst |   5 +
 plugins/admin.c                     | 131 ++++++++++++++++++++------
 profiles/audio/a2dp.c               |  38 +++++++-
 profiles/audio/media.c              |   7 ++
 src/adapter.c                       | 141 ++++++++++++++++++++++++++++
 src/adapter.h                       |   4 +
 src/device.c                        |  35 ++++++-
 11 files changed, 398 insertions(+), 58 deletions(-)

-- 
2.43.0