Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1272637 - acl not getting set on yubikey insertion; yubikey not user accessible
Summary: acl not getting set on yubikey insertion; yubikey not user accessible
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: ykpers
Version: 22
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Maxim Burgerhout
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-10-17 04:38 UTC by John Heidemann
Modified: 2015-11-07 04:07 UTC (History)
4 users (show)

Fixed In Version: ykpers-1.17.2-3.fc23 ykpers-1.17.2-3.fc22 ykpers-1.17.2-3.el7
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-10-20 05:00:12 UTC
Type: Bug
Embargoed:

Attachments (Terms of Use)

Description John Heidemann 2015-10-17 04:38:43 UTC 
Description of problem:

Yubikey neo is no longer accessible by user.
Device apparently not getting user permissions turned on after insertion.


Version-Release number of selected component (if applicable):
ykpers-1.17.2-2.fc22.x86_64


How reproducible:
every time


Steps to Reproduce:
1. insert yubikey
2. gpg --card-status
3.

Actual results:

failure with error
$ gpg --card-status
gpg: selecting openpgp failed: ec=6.108
gpg: OpenPGP card not available: general error


Expected results:

success with output like:
$ gpg --card-status
Application ID ...: D27...0
Version ..........: 2.0
Manufacturer .....: unknown
...

Additional info:

problem goes away when permssions are forced, 
either with sudo gpg --card-status

or chmod `whoami` /dev/bus/usb/001/040
where BUS and DEV appear in journalctl


journalctl has errors, see the "udevd" and "failed to execute" below:

Oct 16 21:04:30 localhost kernel: input: Yubico Yubikey NEO OTP+U2F+CCID as /devices/pci0000:00/0000:00:14.0/usb1/1-2/12:1.0/0003:1050:0116.0035/input/input55
Oct 16 21:04:30 localhost kernel: hid-generic 0003:1050:0116.0035: input,hidraw5: USB HID v1.10 Keyboard [Yubico Yubikey NEO OTP+U2F+CCID] on usb-0000:00:14.0-2/input0
Oct 16 21:04:30 localhost kernel: hid-generic 0003:1050:0116.0036: hiddev0,hidraw6: USB HID v1.10 Device [Yubico Yubikey NEO OTP+U2F+CCID] on usb-0000:00:14.0-2/input1
Oct 16 21:04:30 localhost mtp-probe[23495]: checking bus 1, device 40: "/sys/devices/pci0000:00/0000:00:14.0/usb1/1-2"
Oct 16 21:04:30 localhost mtp-probe[23495]: bus: 1, device: 40 was not an MTP device
Oct 16 21:04:30 localhost systemd-udevd[23497]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=/dev/bus/usb/001/040': No such file or directory
Oct 16 21:04:30 localhost systemd-udevd[23498]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory
Oct 16 21:04:30 localhost systemd-udevd[23499]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory
Oct 16 21:04:30 localhost systemd-udevd[23500]: failed to execute '/usr/lib/udev/udev-acl' 'udev-acl --action=add --device=': No such file or directory


It worked last week :-)


I filed the bug against ykpers since that module owns /usr/lib/udev/rules.d/70-yubikey.rules

but it may belong somewhere else.
Comment 1 Kevin Fenzi 2015-10-17 17:20:48 UTC 
Has anything related been updated in the last week? 

You should be able to look at /var/log/dnf.rpm.log for packages... 

related might be ykpers, systemd*, kernel , *mtp*
Comment 2 John Heidemann 2015-10-17 20:19:50 UTC 
Wrt comment:1 I didn't know about that log.

Yes, it looks like fc22 went ykpers-1.17.1-1.fc22.x86_64 => ykpers-1.17.2-2.fc22.x86_64.

Reverting to ykpers-1.17.1-1 fixes the problem.
Comment 3 Kevin Fenzi 2015-10-17 23:43:27 UTC 
ok. I think I see what the issue is, but not why it's happening yet. ;( 

Thanks for the bug report and will try and have a fixed package to test soon...
Comment 4 Chris Derichs 2015-10-18 00:20:38 UTC 
I just ran into this.

sudo dnf downgrade ykpers solved the issue for me too.

Looks like the rule is trying to run udev-acl but that doesn't exist.

$ sudo dnf provides */udev-acl
Last metadata expiration check performed 1:54:57 ago on Sat Oct 17 17:09:38 2015.
Error: No Matches found

This other bug report makes reference to udev-acl
https://bugzilla.redhat.com/show_bug.cgi?id=859244

"udev release 182 the udev-acl tool is no longer being provided which breaks your test there and is affecting F17+ and any other distro that ships udev 182 or newer"

Back to the downgrade, the reason why that works it seems is that ykpers-1.17.1-1.fc22.x86_64 had different pretty different udev rules

It provided /lib/udev/rules.d/69-yubikey.rules
ACTION!="add|change", GOTO="yubico_end"

# Udev rules for letting the console user access the Yubikey USB
# device node, needed for challenge/response to work correctly.

# Yubico Yubikey II
ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \
    ENV{ID_SECURITY_TOKEN}="1"

LABEL="yubico_end"

vs /lib/udev/rules.d/70-yubikey.rules
# Udev rules for letting the console user access the Yubikey USB
# device node, needed for challenge/response to work correctly.

ACTION=="add|change", SUBSYSTEM=="usb", \
  ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0010|0110|0111|0114|0116|0401|0403|0405|0407|0410", \
  TEST=="/var/run/ConsoleKit/database", \
  RUN+="udev-acl --action=$env{ACTION} --device=$env{DEVNAME}"

I'm not sure what one does that the other doesn't (besides not error out).
Comment 5 Fedora Update System 2015-10-18 19:45:44 UTC 
ykpers-1.17.2-3.el7 has been submitted as an update to Fedora EPEL 7. https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482
Comment 6 Fedora Update System 2015-10-18 19:45:45 UTC 
ykpers-1.17.2-3.fc22 has been submitted as an update to Fedora 22. https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1
Comment 7 Fedora Update System 2015-10-18 19:45:49 UTC 
ykpers-1.17.2-3.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0
Comment 8 Fedora Update System 2015-10-19 05:20:00 UTC 
ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update ykpers'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-7a02606fc1
Comment 9 Fedora Update System 2015-10-19 12:49:00 UTC 
ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'yum --enablerepo=epel-testing update ykpers'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2015-091c0cf482
Comment 10 Fedora Update System 2015-10-19 16:25:27 UTC 
ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
If you want to test the update, you can install it with
$ su -c 'dnf --enablerepo=updates-testing update ykpers'
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-44760589e0
Comment 11 John Heidemann 2015-10-20 05:00:12 UTC 
Yes the -3 fixes this bug.  Thanks for the quick turn-around.
Comment 12 J. Bruce Fields 2015-10-29 21:00:37 UTC 
Just a note to anyone encountering the same problem: also, after upgrading ykpers as described in comment 10 you may need to reinsert the yubikey for the change to take effect.  (At least that was my experience--presumably the change is to udev rules that are triggered on insert?)
Comment 13 J. Bruce Fields 2015-10-29 21:02:18 UTC 
Just a note to anyone encountering the same problem: also, after upgrading ykpers as described in comment 10 you may need to reinsert the yubikey for the change to take effect.  (At least that was my experience--presumably the change is to udev rules that are triggered on insert?)
Comment 14 Fedora Update System 2015-11-01 02:34:13 UTC 
ykpers-1.17.2-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 15 Fedora Update System 2015-11-01 21:51:11 UTC 
ykpers-1.17.2-3.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 16 Fedora Update System 2015-11-07 04:07:55 UTC 
ykpers-1.17.2-3.el7 has been pushed to the Fedora EPEL 7 stable repository. If problems still persist, please make note of it in this bug report.
Note You need to log in before you can comment on or make changes to this bug.