Re: [PATCH v1 1/2] Bluetooth: SCO: require CAP_NET_BIND_SERVICE to bind

[Pauli Virtanen <pav@iki.fi>]

Hi,

pe, 2026-08-28 kello 09:50 -0400, Luiz Augusto von Dentz kirjoitti:
> On Thu, Aug 27, 2026 at 7:41 PM Pauli Virtanen <pav@iki.fi> wrote:
> > to, 2026-08-27 kello 14:01 -0400, Luiz Augusto von Dentz kirjoitti:
> > > From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > > 
> > > SCO sockets have no PSM or port namespace: binding one simply reserves
> > > the ability to accept any incoming eSCO/SCO connection on the adapter.
> > > That is equivalent to listening on a well-known service, which L2CAP
> > > already restricts to CAP_NET_BIND_SERVICE in
> > > l2cap_validate_bredr_psm()/l2cap_validate_le_psm().
> > 
> > In current Linux userspace, sound servers that do HFP listen on SCO
> > sockets, and I think often don't have CAP_NET_BIND_SERVICE.
> > 
> > Do they continue working with this change?
> 
> Good question, that said this is a part of security hardening
> otherwise any process could start listening to an SCO connection, and
> the sound server would stop working. Btw, does the sound server have
> any special capability to, let's say, open the sound card device so
> perhaps we can gate it on sound capability as well.

For ALSA, the sound hardware access is controlled by device file
permissions in /dev/snd/*  Not sure if that's usable here, or if
there's some other per-user controlled solution that could be used.

In most current distros sound server runs with user permissions without
special capabilities, and don't have CAP_NET_BIND_SERVICE, so I'd
expect this patch breaks userspace.

Giving this capability to them allows binding to low network ports, so
it probably makes the hardening issue worse and not better.

The next simplest is probably separate executable with setcap bit set,
which gives a SCO listen socket for those who can run it based on file
permissions.

For ISO bluetoothd manages this (so can be gated with DBus/selinux
policies), and it could make sense for it to be made to work like that
for SCO too.

> > > Apply the same restriction to sco_sock_bind() so unprivileged processes
> > > can no longer hijack incoming SCO links.
> > > 
> > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> > > Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> > > ---
> > >  net/bluetooth/sco.c | 7 +++++++
> > >  1 file changed, 7 insertions(+)
> > > 
> > > diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
> > > index 3d4362a09df4..e4c26551e513 100644
> > > --- a/net/bluetooth/sco.c
> > > +++ b/net/bluetooth/sco.c
> > > @@ -667,6 +667,13 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr_unsized *addr,
> > > 
> > >       BT_DBG("sk %p %pMR", sk, &sa->sco_bdaddr);
> > > 
> > > +     /* Binding a SCO socket reserves the ability to accept any incoming
> > > +      * eSCO/SCO connection on the adapter, so restrict it in the same way
> > > +      * L2CAP restricts well-known PSMs.
> > > +      */
> > > +     if (!capable(CAP_NET_BIND_SERVICE))
> > > +             return -EACCES;
> > > +
> > >       lock_sock(sk);
> > > 
> > >       if (sk->sk_state != BT_OPEN) {
> > 
> > --
> > Pauli Virtanen
> 
>