bluez/android/bluetoothd.te

type bluetoothd, domain;
type bluetoothd_exec, exec_type, file_type;
type bluetoothd_main_exec, exec_type, file_type;

# Start bluetoothd from init
init_daemon_domain(bluetoothd)

# Data file accesses
allow bluetoothd bluetooth_data_file:dir w_dir_perms;
allow bluetoothd bluetooth_data_file:notdevfile_class_set create_file_perms;

allow bluetoothd self:capability { setuid net_admin net_bind_service net_raw };
allow bluetoothd kernel:system module_request;

# TODO: this may be romoved for userbuild where we don't use bluetoothd_wrapper
allow bluetoothd bluetoothd_main_exec:file { execute execute_no_trans read open };

# IPC socket communication
allow bluetoothd self:socket { create_socket_perms accept listen setopt getopt };

# Allow clients to use a socket provided by the bluetooth app.
allow bluetoothd { bluetooth mediaserver }:unix_stream_socket connectto;

# Allow system app to use sockets and fds
allow bluetooth bluetoothd:fd use;
allow bluetooth bluetoothd:unix_stream_socket rw_socket_perms;

# Allow user bluetooth apps to use sockets and fds
allow bluetoothdomain bluetoothd:fd use;
allow bluetoothdomain bluetoothd:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };

# Other domains that can create and use bluetooth sockets.
allow bluetoothdomain self:socket create_socket_perms;

#This we might should put to mediaserver.te ?
allow mediaserver bluetoothd:fd use;
allow mediaserver bluetoothd:socket rw_socket_perms;

# needs /system/bin/log access
allow bluetoothd devpts:chr_file rw_file_perms;

# access to uhid device
allow bluetoothd uhid_device:chr_file rw_file_perms;

# tethering
allow bluetoothd self:udp_socket create_socket_perms;
allow bluetoothd self:tcp_socket { create ioctl };