Sometimes USB device gets rejected even though it's permanently allowed

[ibahnasy]

This is a very old issue since Ubuntu 24.04 and still happening on kernel 7.0.0 on Ubuntu 26.04.

I permanently allowed a Yubikey which works but after sometime of locked screen and when I try to login again, it reject the device even if I re-plugged it.
If I rebooted, it works fine again until this issue reoccurs.

[HeikoNardmann]

"Sometimes" errors often are related to race conditions. Which brings us to #688.

I wonder whether you can rebuild usbguard using the patches from #688 and test it?

[ibahnasy]

Actually this issue happens after locking the screen for a while, it starts rejecting the key but if I rebooted it works fine.
Could this be related to usbguard policy that is applied if the screen is locked?

[HeikoNardmann]

As far as I can tell usbguard does not know anything about screens or screen locking.
So the question is who calls the usbguard CLI (or communicates using DBus) with which arguments.

[muelli]

Are you running GNOME? It blocks new devices (except HID) when the screen is locked.
It should allow devices after the screen is unlocked, though.

[ibahnasy]

Yes it's Gnome and I'm using a Yubikey to unlock gnome-shell session as U2F!
It has worked few years before.
Is it possible to make it working again?

[muelli]

Interesting setup. Do you mind sharing details how you set it up?

Anyway, Ubuntu only activated the USB protection for 24.04.
You can turn the USB protection off in the system settings.
Otherwise, you can run dconf-editor and navigate to org.gnome.desktop.privacy and toggle the usb-protection flag.

[ibahnasy]

@muelli To enable U2F with Yubikey you should install the packages: pamu2fcfg, libpam-u2f.
Then edit this file: /etc/pam.d/common-auth and add: auth required pam_u2f.so authfile=/etc/ykey.
Create a unique ID for your Yubikey: pamu2fcfg -n <user> > /etc/ykey.

This will enable the U2F for GDM, sudo, etc. anything that is using PAM, or you can specify which pam.d file you need.

While configuring this, better keep an opened root session in another tty just in case you are locked!

[ibahnasy]

Seems Gnome USB protection is the culprit.