In IoT, a flexible and trustworthy access control framework is of significance to ensure the security of lightweight IoT devices. The conventional centralized access control framework is no longer fit for the open and large-scale IoT environments. In this paper, we propose an attribute-based distributed access control framework (ADAC) for IoT using blockchain technology. The attributes, such as manufacturer and object-specified attribute, are considered in the proposed ADAC for more fine-grained access control in the open and lightweight IoT devices. Particularly, we design a smart contract system, which includes a subject contract (SC), an object contract (OC), an access control contract (ACC) and multiple policy contracts (PCs), to manage and access attributes of IoT devices for distributed and trustworthy access control (DTAC). SC and OC are responsible for managing subject attribute and object attribute information, respectively. PCs are used to manage access control policies. ACC performs authorization judgment by accessing attributes and policies. Finally, a case study is performed to demonstrate the workflow and show that ADAC could achieve fine-grained and flexible access control for IoT.