interfaces: bluez: allow file descriptors to be shared via dbus

The bluetooth stack implements a way to circumvent the bluez socket and
instead communicate over DBus to share a file descriptor between two
different process IDs. This apparmor rule allows such file descriptor
exchanging to be allowed.

Signed-off-by: Dilyn Corner <dilyn.corner@canonical.com>

interfaces/builtin/bluez.go

@@ -147,6 +147,9 @@ const bluezConnectedSlotAppArmor = `
 dbus (receive, send)
     bus=system
     peer=(label=###PLUG_SECURITY_TAGS###),
+
+# Allow sharing file descriptors (via DBus)
+unix (send,receive) type="seqpacket" addr=none peer=(addr=none label=###PLUG_SECURITY_TAGS###),
 `
 
 const bluezConnectedPlugAppArmor = `
@@ -186,6 +189,9 @@ dbus (receive)
 
 # Allow access to bluetooth audio streams
 network bluetooth,
+
+# Allow use of shared (via DBus) file descriptors
+unix (send, receive) type="seqpacket" addr=none peer=(addr=none label=###SLOT_SECURITY_TAGS###),
 `
 
 const bluezPermanentSlotSecComp = `