In my previous post, I talked about the udev hack I had used with the YubiKey and how it was not the correct way to do things. I recieved a lot of feedback on this post, and here I'm hoping to summarise what the correct way to do it is.
The rule I was originally using was:
SUBSYSTEMS=="usb", ATTRS idVendor =="1050",ATTRS idProduct =="0111", OWNER="irl"
The problem with this rule was that it always made my own username the owner of the YubiKey. For my use on my laptop, this was fine, as I'm the only user ever logged into my laptop, but this is not the right way to do this.
On a multi-user system you would want the user logged into the console, and so the one that has plugged in the USB device by implication, to be the owner of the device.
Sam Morris followed up to my last post by e-mail to suggest the following rule:
SUBSYSTEMS=="usb", ATTRS idVendor =="1050", ATTRS idProduct =="0111", TAG+="uaccess"
The difference here is that instead of explicitly setting an owner, the
uaccess tag is added to the device. This tag has meaning to
systemd-logind and will add the necessary ACLs to the device to allow the console user to access it. The ACL should also be removed by
systemd-logind when you log out.
He also suggested using
getfacl (from the
acl package) to check the ACLs that have been assigned to devices.
irl@orbiter$ getfacl /dev/hidraw0
# file: hidraw0
# owner: irl
# group: root
user::rw-
user:irl:rw-
group::---
mask::rw-
other::---
Here we can see that the device has been set to being owned by my username.
(Note that on your system, the YubiKey may have a different path, check your dmesg output to see what device name it is assigned.)
If you don't have
systemd-logind available, fear not as there is an alternative approach you can take that was suggested by
Simon Josefsson, who actually wrote a blog post in 2014 about
using an offline GnuPG master key with subkeys on a YubiKey. If you install the
pcscd package this will provide you with a daemon that runs as root and provides access to the smartcard for ordinary users. I haven't looked at how
pcscd handles limiting access to the device for other users as this isn't an approach I've taken.
Thanks to everyone who gave feedback, I feel like I've learnt something and taken another step closer to doing things The Right Way .
Sam Morris reported the Debian