search

klali / ha-plejd

Plejd component for Home Assistant
Apache License 2.0
69 stars 15 forks source link

dbus app-armor blocking? #44

Open prebbz opened 3 years ago

prebbz commented 3 years ago

Hi,

I have taken a break from getting this plugin to work for a while as my bluez version was too old. I finally got around to updating it to a more respectable 5.46, but get the following errors when starting HA (Home assistant is running in a docker image, bluetoothd is running outside docker)

home-assistant | 2021-04-08 22:28:56 ERROR (MainThread) [homeassistant.components.light] Error while setting up plejd platform for light home-assistant | Traceback (most recent call last): home-assistant | File "/usr/src/homeassistant/homeassistant/helpers/entity_platform.py", line 200, in _async_setup_platform home-assistant | await asyncio.shield(task) home-assistant | File "/config/custom_components/plejd/light.py", line 478, in async_setup_platform home-assistant | await connect(plejdinfo) home-assistant | File "/config/custom_components/plejd/light.py", line 174, in connect home-assistant | om_introspection = await bus.introspect(BLUEZ_SERVICE_NAME, '/') home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/aio/message_bus.py", line 216, in introspect home-assistant | return await asyncio.wait_for(future, timeout=timeout) home-assistant | File "/usr/local/lib/python3.8/asyncio/tasks.py", line 494, in wait_for home-assistant | return fut.result() home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/message_bus.py", line 196, in reply_notify home-assistant | BaseMessageBus._check_method_return(reply, err, 's') home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/message_bus.py", line 605, in _check_method_return home-assistant | raise err home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/aio/message_bus.py", line 366, in _message_reader home-assistant | if self._unmarshaller.unmarshall(): home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 304, in unmarshall home-assistant | self._unmarshall() home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 243, in _unmarshall home-assistant | self.read(16, prefetch=True) home-assistant | File "/usr/local/lib/python3.8/site-packages/dbus_next/_private/unmarshaller.py", line 91, in read home-assistant | raise EOFError() home-assistant | EOFError

When running dbus-monitor, i get a clue as to what might be wrong:

method call time=1617913736.312933 sender=:not.active.yet -> destination=org.freedesktop.DBus serial=1 path=/org/freedesktop/DBus; interface=org.freedesktop.DBus; member=Hello error time=1617913736.312955 sender=org.freedesktop.DBus -> destination=:not.active.yet error_name=org.freedesktop.DBus.Error.AccessDenied reply_serial=1 string "An AppArmor policy prevents this sender from sending this message to this recipient; type="method_call", sender="(null)" (inactive) interface="org.freedesktop.DBus" member="Hello" error name="(unset)" requested_reply="0" destination="org.freedesktop.DBus" (bus)" method call time=1617913736.380199 sender=:not.active.yet -> destination=org.bluez serial=2 path=/; interface=org.freedesktop.DBus.Introspectable; member=Introspect

My guess is some policy mög which is killing all communication from the container to the bluetooth daemon. Anyone else had this problem and have any tips to fix it? Thanks in advance

klali commented 3 years ago

The dbus permissions for bluetooth should be in /etc/dbus-1/system.d/bluetooth.conf (or similar), the user in the container needs to have permissions to communicate there. For me it lists the bluetooth group which I have my homeassistant user in:

  <policy group="bluetooth">
    <allow send_destination="org.bluez"/>
  </policy>
prebbz commented 3 years ago

Are you running bluez in the container? My home-assistant docker container runs as root, but is not the same root as my host linux machine, so thus it can't communicate with bluez. Do you specify a host system user for your container? Please feel free to post a sample of your docker-compose file for HA ?

klali commented 3 years ago

I don't run containers at all.

I'm not entirely sure, but if you have the default bluez setup you're going to have to make sure that the user the process actually runs as is a member of the bluetooth group on the host machine.

In https://github.com/edgexfoundry-holding/device-bluetooth-c they seem to have a bluetooth policy for using in an unprivileged container, that might be worth looking at.