7

I’ve been prototyping a BLE peripheral running as root on a small raspberry like board. Now I’m hardening things and partitioning the BLE app to a non-root user. So I've changed my systemd service file for the app to look like:

[Unit]
Description=BLE Peripheral

[Service]
Type=simple
ExecStart=/usr/bin/python3 -u /opt/myPeripheral/bleMainloop
WorkingDirectory=/opt/myPeripheral
StandardOutput=journal
Restart=on-failure
User=blePeripheral

[Install]
WantedBy=multi-user.target 

Having added the User field to run as the blePeripheral user, it now fails to start due to:

dbus.exceptions.DBusException: org.freedesktop.DBus.Error.AccessDenied: Rejected send message, 2 matched rules; type="method_call", sender=":1.6797" (uid=107 pid=17300 comm="/usr/bin/python3 -u /opt/pilot/bleMainloop ") interface="org.freedesktop.DBus.ObjectManager" member="GetManagedObjects" error name="(unset)" requested_reply="0" destination=":1.2" (uid=0 pid=1373 comm="/usr/lib/bluetooth/bluetoothd -d -E --noplugin=* “)

I think what I need to do is somehow allow certain uses of dbus for this non-root user. I see that there’s a bluetooth.conf in /etc/dbus-1/system.d. Do I need to tune something in this file to allow my app to still use the BLE DBus services?

7

In /etc/dbus-1/system.d/bluetooth.conf, try adding this:

<policy user="blePeripheral">
  <allow own="org.bluez"/>
  <allow send_destination="org.bluez"/>
  <allow send_interface="org.bluez.GattCharacteristic1"/>
  <allow send_interface="org.bluez.GattDescriptor1"/>
  <allow send_interface="org.freedesktop.DBus.ObjectManager"/>
  <allow send_interface="org.freedesktop.DBus.Properties"/>
</policy>

Then restart the dbus service:

systemctl restart dbus
5

While technically @Mark's answer answered the question of how to tune the dbus bluetooth config file to achieve what I want, I noticed after looking in that file something I wish I'd noticed before posting. The bluetooth group gets access to the bus. So the easier (more correct maybe?) thing for me to do was simply add my non-root user to the bluetooth group. Which also allows things to work just fine.

  • 1
    Are you using BLE for connecting to other devices or does your application advertise services via BLE? I tried those solutions, but advertising still doesn't work without root privileges. – pwuertz Mar 10 '17 at 9:59
  • My raspberry like board is playing the role of peripheral. So yes, it is advertising. I am using debian stretch with a 4.8.10 kernel and bluez 5.43. I was using jessie with the same setup. You do have to tweak the bluetooth daemon to run with the -E (experimental) flag. HTH @pwuertz – Travis Griggs Mar 10 '17 at 16:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.