import bluez-5.50-1.el8

This commit is contained in:
CentOS Sources 2019-05-07 06:48:45 -04:00
commit e0630b7f32
16 changed files with 1582 additions and 0 deletions

1
.bluez.metadata Normal file
View File

@ -0,0 +1 @@
a59289c91ccb7fac248e916838d4e66d7936151e SOURCES/bluez-5.50.tar.xz

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
SOURCES/bluez-5.50.tar.xz

View File

@ -0,0 +1,51 @@
From 2c3bba7b38be03834162e34069156f1fd49f0528 Mon Sep 17 00:00:00 2001
From: "antoine.belvire@laposte.net" <antoine.belvire@laposte.net>
Date: Tue, 27 Mar 2018 20:30:26 +0200
Subject: [PATCH] adapter: Don't refresh adv_manager for non-LE devices
btd_adv_manager_refresh is called upon MGMT_SETTING_DISCOVERABLE setting change
but as only LE adapters have an adv_manager, this leads to segmentation fault
for non-LE devices:
0 btd_adv_manager_refresh (manager=0x0) at src/advertising.c:1176
1 0x0000556fe45fcb02 in settings_changed (settings=<optimized out>,
adapter=0x556fe53f7c70) at src/adapter.c:543
2 new_settings_callback (index=<optimized out>, length=<optimized out>,
param=<optimized out>, user_data=0x556fe53f7c70) at src/adapter.c:573
3 0x0000556fe462c278 in request_complete (mgmt=mgmt@entry=0x556fe53f20c0,
status=<optimized out>, opcode=opcode@entry=7, index=index@entry=0,
length=length@entry=4, param=0x556fe53eb5f9) at src/shared/mgmt.c:261
4 0x0000556fe462cd9d in can_read_data (io=<optimized out>,
user_data=0x556fe53f20c0) at src/shared/mgmt.c:353
5 0x0000556fe46396e3 in watch_callback (channel=<optimized out>,
cond=<optimized out>, user_data=<optimized out>)
at src/shared/io-glib.c:170
6 0x00007fe351c980e5 in g_main_context_dispatch ()
from /usr/lib64/libglib-2.0.so.0
7 0x00007fe351c984b0 in ?? () from /usr/lib64/libglib-2.0.so.0
8 0x00007fe351c987c2 in g_main_loop_run () from /usr/lib64/libglib-2.0.so.0
9 0x0000556fe45abc75 in main (argc=<optimized out>, argv=<optimized out>)
at src/main.c:770
This commit prevents the call to btd_adv_manager_refresh for non-LE devices.
---
src/adapter.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/src/adapter.c b/src/adapter.c
index 6b9222bcf..daccfdc19 100644
--- a/src/adapter.c
+++ b/src/adapter.c
@@ -540,7 +540,8 @@ static void settings_changed(struct btd_adapter *adapter, uint32_t settings)
g_dbus_emit_property_changed(dbus_conn, adapter->path,
ADAPTER_INTERFACE, "Discoverable");
store_adapter_info(adapter);
- btd_adv_manager_refresh(adapter->adv_manager);
+ if (adapter->supported_settings & MGMT_SETTING_LE)
+ btd_adv_manager_refresh(adapter->adv_manager);
}
if (changed_mask & MGMT_SETTING_BONDABLE) {
--
2.17.0

View File

@ -0,0 +1,35 @@
From 69d2e7bebb79f500179298c6c51fafbc217df6c8 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 20 Sep 2017 12:49:10 +0200
Subject: [PATCH 1/4] build: Always define confdir and statedir
As we will need those paths to lock down on them.
---
Makefile.am | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/Makefile.am b/Makefile.am
index 555f301ca..1c38d94e5 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -30,14 +30,14 @@ include_HEADERS =
AM_CFLAGS = $(WARNING_CFLAGS) $(MISC_CFLAGS)
AM_LDFLAGS = $(MISC_LDFLAGS)
+confdir = $(sysconfdir)/bluetooth
+statedir = $(localstatedir)/lib/bluetooth
+
if DATAFILES
dbusdir = @DBUS_CONFDIR@/dbus-1/system.d
dbus_DATA = src/bluetooth.conf
-confdir = $(sysconfdir)/bluetooth
conf_DATA =
-
-statedir = $(localstatedir)/lib/bluetooth
state_DATA =
endif
--
2.14.1

View File

@ -0,0 +1,31 @@
From e45c8fdcb3d7cdb654f6819c02d1bbb5b40b6116 Mon Sep 17 00:00:00 2001
From: Florian Weimer <fweimer@redhat.com>
Date: Thu, 7 Nov 2013 09:23:35 +0100
Subject: [PATCH 1/4] build: Enable BIND_NOW
Partial RELRO means that the object is GNU_RELRO but not BIND_NOW. This
reduces the effectiveness of RELRO. bluez triggers this because it
enables PIE during the build, and rpmdiff takes this as an indicator
that the best possible hardening is desired.
https://bugzilla.redhat.com/show_bug.cgi?id=983161
---
acinclude.m4 | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/acinclude.m4 b/acinclude.m4
index bc39c6d73..efce2f3cb 100644
--- a/acinclude.m4
+++ b/acinclude.m4
@@ -50,7 +50,7 @@ AC_DEFUN([MISC_FLAGS], [
if (test "${enableval}" = "yes" &&
test "${ac_cv_prog_cc_pie}" = "yes"); then
misc_cflags="$misc_cflags -fPIC"
- misc_ldflags="$misc_ldflags -pie"
+ misc_ldflags="$misc_ldflags -pie -Wl,-z,now"
fi
])
if (test "$enable_coverage" = "yes"); then
--
2.14.1

View File

@ -0,0 +1,38 @@
From cba55944f76ad0f01bb7c8976fd6699f058c68cd Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 20 Sep 2017 14:42:14 +0200
Subject: [PATCH] hostname: Fix "BlueZ 5.XX" adapter name on startup
The hostname plugin listens to property changes from systemd-hostnamed
but doesn't fetch initial values. This means that unless the
PrettyHostname or StaticHostname changes, the default adapter will be
called "BlueZ 5.XX" matching the version number.
This is the case since the hostname plugin replaced the adaptername
plugin in 2012.
Fetch the initial values for PrettyHostname, StaticHostname and
Chassis when the plugin is initiated, so as to make the values
available for adapter setup.
---
plugins/hostname.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/plugins/hostname.c b/plugins/hostname.c
index f876d0afb..db9187378 100644
--- a/plugins/hostname.c
+++ b/plugins/hostname.c
@@ -307,6 +307,10 @@ static int hostname_init(void)
hostname_proxy = NULL;
g_dbus_client_unref(hostname_client);
hostname_client = NULL;
+ } else {
+ g_dbus_proxy_refresh_property(hostname_proxy, "PrettyHostname");
+ g_dbus_proxy_refresh_property(hostname_proxy, "StaticHostname");
+ g_dbus_proxy_refresh_property(hostname_proxy, "Chassis");
}
return err;
--
2.14.1

View File

@ -0,0 +1,38 @@
From 90b72b787a6ae6b9b0bf8ece238e108e8607a433 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Sat, 9 Nov 2013 18:13:43 +0100
Subject: [PATCH 1/2] obex: Use GLib helper function to manipulate paths
Instead of trying to do it by hand. This also makes sure that
relative paths aren't used by the agent.
---
obexd/src/manager.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/obexd/src/manager.c b/obexd/src/manager.c
index f84384ae4..285c07c37 100644
--- a/obexd/src/manager.c
+++ b/obexd/src/manager.c
@@ -650,14 +650,14 @@ static void agent_reply(DBusPendingCall *call, void *user_data)
DBUS_TYPE_STRING, &name,
DBUS_TYPE_INVALID)) {
/* Splits folder and name */
- const char *slash = strrchr(name, '/');
+ gboolean is_relative = !g_path_is_absolute(name);
DBG("Agent replied with %s", name);
- if (!slash) {
- agent->new_name = g_strdup(name);
+ if (is_relative) {
+ agent->new_name = g_path_get_basename(name);
agent->new_folder = NULL;
} else {
- agent->new_name = g_strdup(slash + 1);
- agent->new_folder = g_strndup(name, slash - name);
+ agent->new_name = g_path_get_basename(name);
+ agent->new_folder = g_path_get_dirname(name);
}
}
--
2.14.1

View File

@ -0,0 +1,38 @@
From 4570164f0c90603bd07eb9e7c07e17bbafb5b5da Mon Sep 17 00:00:00 2001
From: Craig Andrews <candrews@integralblue.com>
Date: Wed, 13 Sep 2017 15:23:09 +0200
Subject: [PATCH 2/4] systemd: Add PrivateTmp and NoNewPrivileges options
PrivateTmp makes bluetoothd's /tmp and /var/tmp be inside a different
namespace. This is useful to secure access to temporary files of the
process.
NoNewPrivileges ensures that service process and all its children
can never gain new privileges through execve(), lowering the risk of
possible privilege escalations.
---
src/bluetooth.service.in | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
index f799f65f0..a6f3030f9 100644
--- a/src/bluetooth.service.in
+++ b/src/bluetooth.service.in
@@ -12,8 +12,14 @@ NotifyAccess=main
#Restart=on-failure
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
LimitNPROC=1
+
+# Filesystem lockdown
ProtectHome=true
ProtectSystem=full
+PrivateTmp=true
+
+# Privilege escalation
+NoNewPrivileges=true
[Install]
WantedBy=bluetooth.target
--
2.14.1

View File

@ -0,0 +1,43 @@
From 73a9c0902e7c97adf96e735407a75033152c04a9 Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 13 Sep 2017 15:37:11 +0200
Subject: [PATCH 3/4] systemd: Add more filesystem lockdown
We can only access the configuration file as read-only and read-write
to the Bluetooth cache directory and sub-directories.
---
Makefile.am | 2 ++
src/bluetooth.service.in | 4 ++++
2 files changed, 6 insertions(+)
diff --git a/Makefile.am b/Makefile.am
index 1c38d94e5..13ccf9079 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -478,6 +478,8 @@ MAINTAINERCLEANFILES = Makefile.in \
SED_PROCESS = $(AM_V_GEN)$(MKDIR_P) $(dir $@) && \
$(SED) -e 's,@libexecdir\@,$(libexecdir),g' \
+ -e 's,@statedir\@,$(statedir),g' \
+ -e 's,@confdir\@,$(confdir),g' \
< $< > $@
%.service: %.service.in Makefile
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
index a6f3030f9..7e55b5043 100644
--- a/src/bluetooth.service.in
+++ b/src/bluetooth.service.in
@@ -17,6 +17,10 @@ LimitNPROC=1
ProtectHome=true
ProtectSystem=full
PrivateTmp=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+ReadWritePaths=@statedir@
+ReadOnlyPaths=@confdir@
# Privilege escalation
NoNewPrivileges=true
--
2.14.1

View File

@ -0,0 +1,41 @@
From 07a12a6685ea57be18f39e349dbc42e4af3744ed Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Tue, 5 Sep 2017 10:32:15 +0200
Subject: [PATCH 3/4] tools/csr_usb: Fix compilation failure
GCC's "format-nonliteral" security check is enabled as an error in
recent versions of Fedora. Given the reduced scope of use, mark the
error as ignorable through pragma.
tools/csr_usb.c: In function 'read_value':
tools/csr_usb.c:82:2: error: format not a string literal, argument types not checked [-Werror=format-nonliteral]
n = fscanf(file, format, &value);
^
---
tools/csr_usb.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tools/csr_usb.c b/tools/csr_usb.c
index a1d7324f7..33e9968a2 100644
--- a/tools/csr_usb.c
+++ b/tools/csr_usb.c
@@ -67,6 +67,8 @@ struct usbfs_bulktransfer {
#define USBFS_IOCTL_CLAIMINTF _IOR('U', 15, unsigned int)
#define USBFS_IOCTL_RELEASEINTF _IOR('U', 16, unsigned int)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
static int read_value(const char *name, const char *attr, const char *format)
{
char path[PATH_MAX];
@@ -88,6 +90,7 @@ static int read_value(const char *name, const char *attr, const char *format)
fclose(file);
return value;
}
+#pragma GCC diagnostic pop
static char *check_device(const char *name)
{
--
2.14.1

View File

@ -0,0 +1,34 @@
From 171d812218883281fed57b57fafd5c18eac441ac Mon Sep 17 00:00:00 2001
From: Bastien Nocera <hadess@hadess.net>
Date: Wed, 13 Sep 2017 15:38:26 +0200
Subject: [PATCH 4/4] systemd: More lockdown
bluetoothd does not need to execute mapped memory, or real-time
access, so block those.
---
src/bluetooth.service.in | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/src/bluetooth.service.in b/src/bluetooth.service.in
index 7e55b5043..e8267b338 100644
--- a/src/bluetooth.service.in
+++ b/src/bluetooth.service.in
@@ -22,9 +22,15 @@ ProtectControlGroups=true
ReadWritePaths=@statedir@
ReadOnlyPaths=@confdir@
+# Execute Mappings
+MemoryDenyWriteExecute=true
+
# Privilege escalation
NoNewPrivileges=true
+# Real-time
+RestrictRealtime=true
+
[Install]
WantedBy=bluetooth.target
Alias=dbus-org.bluez.service
--
2.14.1

View File

@ -0,0 +1,33 @@
# Some devices have a bluetooth HCI connected to an uart, these needs to be
# setup by calling btattach. The systemd btattach-bcm.service takes care of
# this. These udev rules hardware-activate that service when necessary.
#
# For now this only suports ACPI enumerated Broadcom BT HCIs.
# This has been tested on Bay and Cherry Trail devices with both ACPI and
# PCI enumerated UARTs.
# Note we check for the platform device not for the acpi device, because
# some DSDTs list multiple bluetooth adapters, but only some (or none)
# are enabled. Only enabled adapters get a platform device created.
ACTION!="add", GOTO="btattach_bcm_rules_end"
SUBSYSTEM!="platform", GOTO="btattach_bcm_rules_end"
KERNEL=="BCM2E1A:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E39:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E3A:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E3D:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E3F:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E40:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E54:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E55:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E64:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E65:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E67:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E71:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E7B:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E7C:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E7E:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E95:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
KERNEL=="BCM2E96:00", TAG+="systemd", ENV{SYSTEMD_WANTS}="btattach-bcm@%k.service"
LABEL="btattach_bcm_rules_end"

100
SOURCES/bluez.gitignore Normal file
View File

@ -0,0 +1,100 @@
*.o
*.a
*.lo
*.la
*.so
.deps
.libs
.dirstamp
Makefile
Makefile.in
aclocal.m4
config.guess
config.h
config.h.in
config.log
config.status
config.sub
configure
depcomp
compile
install-sh
libtool
ltmain.sh
missing
stamp-h1
autom4te.cache
ylwrap
lexer.c
parser.h
parser.c
bluez.pc
lib/bluetooth
src/builtin.h
src/bluetoothd
audio/telephony.c
sap/sap.c
scripts/bluetooth.rules
scripts/97-bluetooth.rules
scripts/97-bluetooth-hid2hci.rules
sbc/sbcdec
sbc/sbcenc
sbc/sbcinfo
sbc/sbctester
attrib/gatttool
tools/avctrl
tools/avinfo
tools/bccmd
tools/ciptool
tools/dfubabel
tools/dfutool
tools/hciattach
tools/hciconfig
tools/hcieventmask
tools/hcisecfilter
tools/hcitool
tools/hid2hci
tools/rfcomm
tools/l2ping
tools/ppporc
tools/sdptool
cups/bluetooth
test/agent
test/bdaddr
test/hciemu
test/attest
test/hstest
test/avtest
test/l2test
test/rctest
test/scotest
test/gaptest
test/sdptest
test/lmptest
test/ipctest
test/btiotest
test/test-textfile
test/uuidtest
test/mpris-player
compat/dund
compat/hidd
compat/pand
unit/test-eir
mgmt/btmgmt
monitor/btmon
emulator/btvirt
doc/*.bak
doc/*.stamp
doc/bluez.*
doc/bluez-*.txt
doc/*.sgml
doc/version.xml
doc/xml
doc/html
src/bluetoothd.8
src/bluetooth.service

View File

@ -0,0 +1,30 @@
#!/bin/bash
# Simple shell script to wait for the tty for an uart using BT HCI to show up
# and then invoke btattach with the right parameters, this is intended to be
# invoked from a hardware-activated systemd service
#
# For now this only suports ACPI enumerated Broadcom BT HCIs.
# This has been tested on Bay and Cherry Trail devices with both ACPI and
# PCI enumerated UARTs.
#
# Note the kernel bt developers are working on solving this entirely in the
# kernel, so it is not worth the trouble to write something better then this.
BT_DEV="/sys/bus/platform/devices/$1"
BT_DEV="$(readlink -f $BT_DEV)"
UART_DEV="$(dirname $BT_DEV)"
# Stupid GPD-pocket has USB BT with id 0000:0000, but still claims to have
# an uart attached bt
if [ "$1" = "BCM2E7E:00" ] && lsusb | grep -q "ID 0000:0000"; then
exit 0
fi
while [ ! -d "$UART_DEV/tty" ]; do
sleep .2
done
TTY="$(ls $UART_DEV/tty)"
exec btattach --bredr "/dev/$TTY" -P bcm

View File

@ -0,0 +1,6 @@
[Unit]
Description=btattach for Broadcom devices
[Service]
Type=simple
ExecStart=/usr/libexec/bluetooth/btattach-bcm-service.sh %I

1062
SPECS/bluez.spec Normal file

File diff suppressed because it is too large Load Diff