Bluetooth in container (podman) gives dbus-related error: authentication failed: REJECTED: ['EXTERNAL'])

[fat-tire]

The problem

Similar to #76392, but sufficiently different to warrant its own issue. On discovery of the bluetooth device, the bluetooth component fails:

Error during setup of component bluetooth
Traceback (most recent call last):
  File "/usr/src/homeassistant/homeassistant/setup.py", line 235, in _async_setup_component
    result = await task
  File "/usr/src/homeassistant/homeassistant/components/bluetooth/__init__.py", line 244, in async_setup
    elif await _async_has_bluetooth_adapter():
  File "/usr/src/homeassistant/homeassistant/components/bluetooth/__init__.py", line 224, in _async_has_bluetooth_adapter
    return bool(await async_get_bluetooth_adapters())
  File "/usr/src/homeassistant/homeassistant/components/bluetooth/util.py", line 19, in async_get_bluetooth_adapters
    adapters = await get_bluetooth_adapters()
  File "/usr/local/lib/python3.10/site-packages/bluetooth_adapters/__init__.py", line 21, in get_bluetooth_adapters
    bus = await MessageBus(
  File "/usr/local/lib/python3.10/site-packages/dbus_next/aio/message_bus.py", line 149, in connect
    await self._authenticate()
  File "/usr/local/lib/python3.10/site-packages/dbus_next/aio/message_bus.py", line 390, in _authenticate
    response = self._auth._receive_line(await self._auth_readline())
  File "/usr/local/lib/python3.10/site-packages/dbus_next/auth.py", line 78, in _receive_line
    raise AuthError(f'authentication failed: {response.value}: {args}')
dbus_next.errors.AuthError: authentication failed: REJECTED: ['EXTERNAL']

Tried a million configurations / variations in starting up the container, none of which eliminate the problem. Here are some of the things I tried:

-v /run/dbus:/run/dbus:ro
-v /sys/fs/cgroup:/sys/fs/cgroup:ro
-e container=podman
-e XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR
--network=host
--privileged
--cap-add=CAP_NET_RAW,CAP_NET_BIND_SERVICE
--cap-add=NET_ADMIN --cap-add=NET_RAW --cap-add=SYS_ADMIN
--cap-add=all

etc. none of these seem to help though the /run/debus one is certainly required.

FWIW, unless I do --network=host --privileged the following happens inside the container:

bash-5.1# hcitool dev
Devices:
bash-5.1# hciconfig -a
Can't open HCI socket.: Address family not supported by protocol

But when the above is set, I can scan and everything from within the container....

bash-5.1# hcitool dev
Devices:
	hci0	AB:CD:EF:AA:BB:CC
bash-5.1# hciconfig -a
hci0:	Type: Primary  Bus: UART
	BD Address: AB:CD:EF:AA:BB:CC  ACL MTU: 1021:8  SCO MTU: 64:1
	UP RUNNING 
        (etc)
bash-5.1# hcitool scan
Scanning ...
	DE:AD;00:00:BE:EF	[TV] Samsung Series

The bit about needing --network=host --privileged is really another issue but may be helpful for anyone trying to debug this. (Regardless of whether hci0 is seen nor not, I still get the same authentication issue, so I'm not sure if it matters. I think the -v /run/dbus:/run/dbus:ro is the important bit.)

Thx!

What version of Home Assistant Core has the issue?

2022.8.2

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant Container

Integration causing the issue

bluetooth

Link to integration documentation on our website

https://www.home-assistant.io/integrations/bluetooth

Diagnostics information

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

No response

Additional information

Running
Raspi 4
debian bullseye
podman

[probot-home-assistant]

bluetooth documentation
bluetooth source
_{^{(message by IssueLinks)}}

[probot-home-assistant]

Hey there @bdraco, mind taking a look at this issue as it has been labeled with an integration (bluetooth) you are listed as a code owner for? Thanks!
_{^{(message by CodeOwnersMention)}}

[bdraco]

Setting up Dbus access permissions it outside the scope of what the bluetooth integration is capable of.

Like #76392, this needs to be fixed at the host level.

[fat-tire]

Anyone who might be looking for a solution, see here.

Spoiler: Use --userns=keep-id when running the container.