dbus app-armor blocking?

[prebbz]

Hi,

I have taken a break from getting this plugin to work for a while as my bluez version was too old. I finally got around to updating it to a more respectable 5.46, but get the following errors when starting HA (Home assistant is running in a docker image, bluetoothd is running outside docker)

home-assistant | 2021-04-08 22:28:56 ERROR (MainThread) [homeassistant.components.light] Error while setting up plejd platform for light
home-assistant | Traceback (most recent call last):
home-assistant | File "/usr/src/homeassistant/homeassistant/helpers/entity_platform.py", line 200, in _async_setup_platform
home-assistant | await asyncio.shield(task)
home-assistant | File "/config/custom_components/plejd/light.py", line 478, in async_setup_platform
home-assistant | await connect(plejdinfo)
home-assistant | File "/config/custom_components/plejd/light.py", line 174, in connect
home-assistant | om_introspection = await bus.introspect(BLUEZ_SERVICE_NAME, '/')
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/aio/message_bus.py", line 216, in introspect
home-assistant | return await asyncio.wait_for(future, timeout=timeout)
home-assistant | File "/usr/local/lib/python3.8/asyncio/tasks.py", line 494, in wait_for
home-assistant | return fut.result()
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/message_bus.py", line 196, in reply_notify
home-assistant | BaseMessageBus._check_method_return(reply, err, 's')
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/message_bus.py", line 605, in _check_method_return
home-assistant | raise err
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/aio/message_bus.py", line 366, in _message_reader
home-assistant | if self._unmarshaller.unmarshall():
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 304, in unmarshall
home-assistant | self._unmarshall()
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 243, in _unmarshall
home-assistant | self.read(16, prefetch=True)
home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 91, in read
home-assistant | raise EOFError()
home-assistant | EOFError

When running dbus-monitor, i get a clue as to what might be wrong:

method call time=1617913736.312933 sender=:not.active.yet -> destination=org.freedesktop.DBus serial=1 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=Hello
error time=1617913736.312955 sender=org.freedesktop.DBus -> destination=:not.active.yet error_name=org.freedesktop.DBus.Error.AccessDenied reply_serial=1
string "An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)"
method call time=1617913736.380199 sender=:not.active.yet -> destination=org.bluez serial=2 path=/; interface=org.freedesktop.DBus.Introspectable; member=Introspect

My guess is some policy mög which is killing all communication from the container to the bluetooth daemon.
Anyone else had this problem and have any tips to fix it? Thanks in advance

[klali]

The dbus permissions for bluetooth should be in /etc/dbus-1/system.d/bluetooth.conf (or similar), the user in the container needs to have permissions to communicate there. For me it lists the bluetooth group which I have my homeassistant user in:

  <policy group="bluetooth">
    <allow send_destination="org.bluez"/>
  </policy>

[prebbz]

Are you running bluez in the container? My home-assistant docker container runs as root, but is not the same root as my host linux machine, so thus it can't communicate with bluez. Do you specify a host system user for your container? Please feel free to post a sample of your docker-compose file for HA ?

[klali]

I don't run containers at all.

I'm not entirely sure, but if you have the default bluez setup you're going to have to make sure that the user the process actually runs as is a member of the bluetooth group on the host machine.

In https://github.com/edgexfoundry-holding/device-bluetooth-c they seem to have a bluetooth policy for using in an unprivileged container, that might be worth looking at.