15

I’ve been prototyping a BLE peripheral running as root on a small raspberry like board. Now I’m hardening things and partitioning the BLE app to a non-root user. So I've changed my systemd service file for the app to look like:

[Unit]
Description=BLE Peripheral

[Service]
Type=simple
ExecStart=/usr/bin/python3 -u /opt/myPeripheral/bleMainloop
WorkingDirectory=/opt/myPeripheral
StandardOutput=journal
Restart=on-failure
User=blePeripheral

[Install]
WantedBy=multi-user.target

Having added the User field to run as the blePeripheral user, it now fails to start due to:

dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 2 matched rules; type="method_call", sender=":1.6797" (uid=107 pid=17300 comm="/usr/bin/python3 -u /opt/pilot/bleMainloop ") interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" error name="(unset)" requested_reply="0" destination=":1.2" (uid=0 pid=1373 comm="/usr/lib/bluetooth/bluetoothd -d -E --noplugin=* “)

I think what I need to do is somehow allow certain uses of dbus for this non-root user. I see that there’s a bluetooth.conf in /etc/dbus-1/system.d. Do I need to tune something in this file to allow my app to still use the BLE DBus services?

Improve this question

2 Answers 2

Reset to default
13

While technically @Mark's answer answered the question of how to tune the dbus bluetooth config file to achieve what I want, I noticed after looking in that file something I wish I'd noticed before posting. The bluetooth group gets access to the bus. So the easier (more correct maybe?) thing for me to do was simply add my non-root user to the bluetooth group. Which also allows things to work just fine.

Improve this answer
3
  • 1
    Are you using BLE for connecting to other devices or does your application advertise services via BLE? I tried those solutions, but advertising still doesn't work without root privileges.
    – pwuertz
    Mar 10, 2017 at 9:59
  • My raspberry like board is playing the role of peripheral. So yes, it is advertising. I am using debian stretch with a 4.8.10 kernel and bluez 5.43. I was using jessie with the same setup. You do have to tweak the bluetooth daemon to run with the -E (experimental) flag. HTH @pwuertz
    – Travis Griggs
    Mar 10, 2017 at 16:32
  • 2
    I had to sudo systemctl restart dbus to get it working after adding user pi to group bluetooth.
    – Salivan
    Jan 8, 2021 at 17:33
10

In /etc/dbus-1/system.d/bluetooth.conf, try adding this:

<policy user="blePeripheral">
  <allow own="org.bluez"/>
  <allow send_destination="org.bluez"/>
  <allow send_interface="org.bluez.GattCharacteristic1"/>
  <allow send_interface="org.bluez.GattDescriptor1"/>
  <allow send_interface="org.freedesktop.DBus.ObjectManager"/>
  <allow send_interface="org.freedesktop.DBus.Properties"/>
</policy>

Then restart the dbus service:

systemctl restart dbus
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .