Drop full privileged from audio plugin (#2570)

supervisor/docker/audio.py

@@ -61,9 +61,8 @@ class DockerAudio(DockerInterface, CoreSysAttributes):
             name=self.name,
             hostname=self.name.replace("_", "-"),
             detach=True,
-            privileged=True,
             device_cgroup_rules=self.sys_hardware.policy.get_cgroups_rules(
-                PolicyGroup.AUDIO
+                PolicyGroup.AUDIO, PolicyGroup.BLUETOOTH
             ),
             environment={ENV_TIME: self.sys_config.timezone},
             volumes=self.volumes,

supervisor/hardware/const.py

@@ -35,6 +35,7 @@ class PolicyGroup(str, Enum):
     USB = "usb"
     VIDEO = "video"
     AUDIO = "audio"
+    BLUETOOTH = "bluetooth"
 
 
 class HardwareAction(str, Enum):

supervisor/hardware/policy.py

@@ -38,6 +38,9 @@ _CGROUPS: Dict[PolicyGroup, List[int]] = {
         180,  # hiddev (usbmisc)
         243   # hidraw (hidraw)
     ],
+    PolicyGroup.BLUETOOTH: [
+        13    # /dev/input (input)
+    ]
 }
 
 # fmt: on