Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1272637
Summary: | acl not getting set on yubikey insertion; yubikey not user accessible | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | John Heidemann <johnh> |
Component: | ykpers | Assignee: | Maxim Burgerhout <maxim> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | unspecified | Docs Contact: | |
Priority: | unspecified | ||
Version: | 22 | CC: | bfields, chris+rhbugzilla, kevin, maxim |
Target Milestone: | --- | ||
Target Release: | --- | ||
Hardware: | Unspecified | ||
OS: | Unspecified | ||
Whiteboard: | |||
Fixed In Version: | ykpers-1.17.2-3.fc23 ykpers-1.17.2-3.fc22 ykpers-1.17.2-3.el7 | Doc Type: | Bug Fix |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2015-10-20 05:00:12 UTC | Type: | Bug |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: |
Description
John Heidemann
2015-10-17 04:38:43 UTC
Has anything related been updated in the last week? You should be able to look at /var/log/dnf.rpm.log for packages... related might be ykpers, systemd*, kernel , *mtp* Wrt comment:1 I didn't know about that log. Yes, it looks like fc22 went ykpers-1.17.1-1.fc22.x86_64 => ykpers-1.17.2-2.fc22.x86_64. Reverting to ykpers-1.17.1-1 fixes the problem. ok. I think I see what the issue is, but not why it's happening yet. ;( Thanks for the bug report and will try and have a fixed package to test soon... I just ran into this. sudo dnf downgrade ykpers solved the issue for me too. Looks like the rule is trying to run udev-acl but that doesn't exist. $ sudo dnf provides */udev-acl Last metadata expiration check performed 1:54:57 ago on Sat Oct 17 17:09:38 2015. Error: No Matches found This other bug report makes reference to udev-acl https://bugzilla.redhat.com/show_bug.cgi?id=859244 "udev release 182 the udev-acl tool is no longer being provided which breaks your test there and is affecting F17+ and any other distro that ships udev 182 or newer" Back to the downgrade, the reason why that works it seems is that ykpers-1.17.1-1.fc22.x86_64 had different pretty different udev rules It provided /lib/udev/rules.d/69-yubikey.rules ACTION!="add|change", GOTO="yubico_end" # Udev rules for letting the console user access the Yubikey USB # device node, needed for challenge/response to work correctly. # Yubico Yubikey II ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \ ENV{ID_SECURITY_TOKEN}="1" LABEL="yubico_end" vs /lib/udev/rules.d/70-yubikey.rules # Udev rules for letting the console user access the Yubikey USB # device node, needed for challenge/response to work correctly. ACTION=="add|change", SUBSYSTEM=="usb", \ ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \ TEST=="/var/run/ConsoleKit/database", \ RUN+="udev-acl --action=$env{ACTION} --device=$env{DEVNAME}" I'm not sure what one does that the other doesn't (besides not error out). ykpers-1.17.2-3.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482 ykpers-1.17.2-3.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1 ykpers-1.17.2-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0 ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1 ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'yum --enablerepo=epel-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482 ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with $ su -c 'dnf --enablerepo=updates-testing update ykpers' You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0 Yes the -3 fixes this bug. Thanks for the quick turn-around. Just a note to anyone encountering the same problem: also, after upgrading ykpers as described in comment 10 you may need to reinsert the yubikey for the change to take effect. (At least that was my experience--presumably the change is to udev rules that are triggered on insert?) Just a note to anyone encountering the same problem: also, after upgrading ykpers as described in comment 10 you may need to reinsert the yubikey for the change to take effect. (At least that was my experience--presumably the change is to udev rules that are triggered on insert?) ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report. |