Purpose
This article explains how to restrict Bluetooth file transfer on Linux devices by deploying a RunScript job from the SureMDM Console. Once the script is deployed, Bluetooth remains enabled, but file sharing over Bluetooth is blocked, preventing users from sending or receiving files.
Prerequisites
- SureMDM Console with administrative access.
- A Linux device enrolled and managed through SureMDM.
- A RunScript job configured in SureMDM.
- Root privileges available on the target Linux device.
Steps
1. Create a RunScript Job
- Log in to the SureMDM Console.
- Navigate to Jobs.
- Click New Job and select RunScript.
2. Add the Script
- Copy and paste the following script into the RunScript editor.
- Ensure the following variable is set based on the required behavior:
- Setting the value to false disables Bluetooth file transfer.
Note: When the ENABLE_BT_FILE_TRANSFER parameter is set to false, Bluetooth file transfer is blocked, preventing users from sending or receiving files over Bluetooth.
Click here to view the script.
Script:
#!/bin/bash
set -euo pipefail
# true -> enable Bluetooth file transfer
# false -> disable Bluetooth file transfer
ENABLE_BT_FILE_TRANSFER=false
# Resolve the actual login user (not root) whether run via sudo or directly as root
if [[ -n “${SUDO_USER:-}” ]]; then
LOGIN_USER=”$SUDO_USER”
elif [[ “${USER:-root}” != “root” ]]; then
LOGIN_USER=”${USER}”
else
# Fallback: find the user owning the active graphical session
LOGIN_USER=$(loginctl list-sessions –no-legend 2>/dev/null \
| awk ‘{print $3}’ \
| grep -v root \
| head -1)
if [[ -z “$LOGIN_USER” ]]; then
echo “Could not determine the desktop session user. Run via sudo instead.” >&2
exit 1
fi
fi
is_unit_masked() {
local state
state=$(systemctl –global is-enabled “obex.service” 2>/dev/null || true)
[[ “$state” == “masked” ]]
}
is_obexd_running() {
pgrep -x obexd >/dev/null 2>&1
}
is_gnome_bluetooth_running() {
pgrep -x gnome-bluetooth-3 >/dev/null 2>&1 || \
pgrep -f gnome-shell >/dev/null 2>&1
}
is_blueman_running() {
pgrep -x blueman-applet >/dev/null 2>&1
}
ensure_blueman_installed() {
if is_gnome_bluetooth_running; then
return # GNOME handles file transfer natively
fi
if ! command -v blueman-applet >/dev/null 2>&1; then
apt-get install -y blueman >/dev/null 2>&1 || {
echo “Error: Failed to install Blueman. Please install it manually with: sudo apt install blueman” >&2
exit 1
}
fi
}
start_blueman_for_user() {
if is_gnome_bluetooth_running; then
return # GNOME handles file transfer natively
fi
if ! is_blueman_running; then
sudo -u “$LOGIN_USER” DISPLAY=:0 DBUS_SESSION_BUS_ADDRESS=”unix:path=/run/user/$(id -u “$LOGIN_USER”)/bus” \
blueman-applet >/dev/null 2>&1 &
sleep 1
fi
}
stop_blueman_for_user() {
if is_gnome_bluetooth_running; then
return # GNOME handles file transfer natively, nothing to stop
fi
if is_blueman_running; then
pkill -x blueman-applet >/dev/null 2>&1 || true
fi
}
enable_restriction() {
local needs_mask=false
local needs_stop=false
if ! is_unit_masked; then
needs_mask=true
fi
if is_obexd_running; then
needs_stop=true
fi
if [[ “$needs_mask” == false && “$needs_stop” == false ]]; then
echo “Bluetooth file transfer is already disabled.”
return
fi
if [[ “$needs_mask” == true ]]; then
systemctl –global mask “obex.service” >/dev/null 2>&1 || {
echo “Error: Failed to disable Bluetooth file transfer. Check system permissions.” >&2
exit 1
}
fi
if [[ “$needs_stop” == true ]]; then
pkill -x obexd >/dev/null 2>&1 || true
systemctl –user –machine=”${LOGIN_USER}@.host” stop obex.service >/dev/null 2>&1 || true
fi
stop_blueman_for_user
echo “Bluetooth file transfer is now disabled.”
}
disable_restriction() {
local needs_unmask=false
local needs_start=false
if is_unit_masked; then
needs_unmask=true
fi
if ! is_obexd_running; then
needs_start=true
fi
ensure_blueman_installed
if [[ “$needs_unmask” == false && “$needs_start” == false ]]; then
if is_gnome_bluetooth_running || is_blueman_running; then
echo “Bluetooth file transfer is already enabled.”
return
fi
fi
if [[ “$needs_unmask” == true ]]; then
systemctl –global unmask “obex.service” >/dev/null 2>&1 || {
echo “Error: Failed to enable Bluetooth file transfer. Check system permissions.” >&2
exit 1
}
fi
if [[ “$needs_start” == true ]]; then
systemctl –user –machine=”${LOGIN_USER}@.host” enable –now obex.service >/dev/null 2>&1 || true
fi
start_blueman_for_user
echo “Bluetooth file transfer is now enabled.”
}
main() {
if [[ “$EUID” -ne 0 ]]; then
echo “Run this script as root.” >&2
exit 1
fi
if [[ “$ENABLE_BT_FILE_TRANSFER” == true ]]; then
disable_restriction
else
enable_restriction
fi
}
main “$@”
3. Save the RunScript Job
- Save the RunScript job.
- Assign the job to the required Linux device or device group.
4. Deploy the Job
- Deploy the RunScript job to the target device.
- Wait for the job to complete successfully.
5. Verify the Restriction
After the job has been applied:
- Open the Bluetooth Settings on the Linux device.
- Verify that Bluetooth remains enabled.
- Attempt to send or receive a file using Bluetooth.
- Confirm that Bluetooth file sharing is blocked and file transfer is no longer possible.
Expected Result
After successful deployment of the RunScript job:
- Bluetooth functionality remains enabled for device connectivity.
- Bluetooth file transfer (OBEX) is disabled.
- Users are unable to send or receive files through Bluetooth.
Conclusion
By deploying this RunScript job through SureMDM, administrators can effectively restrict Bluetooth file transfer on Linux devices without disabling Bluetooth entirely. This helps improve data security by preventing unauthorized file sharing while allowing Bluetooth peripherals such as keyboards, mice, and headsets to continue functioning normally.
Need more help? Here’s how to get help from our experts.
CONTACT US