1
Diagnostic step 1
Collect current udev rules: sudo udevadm info -a -p /sys/class HID device path for a key and check /etc/udev/rules.d/ and /lib/udev/rules.d/ for conflicting rules. Do not edit rules in place without change control.
FULL AI ANALYSIS
Linux browser cannot use FIDO2 security keys after udev rule update — hidraw devices inaccessible to non-root
Generated Oct 13, 2026, 9:45:52 AM
Analysis summary
Browsers rely on udev rules to grant non-root user access to hidraw devices representing FIDO2 tokens. A configuration change that sets devices root:root 0600 prevents normal users from accessing them and breaks WebAuthn. The temporary chown confirms permission is the immediate blocker. The correct fix is to adjust udev rules to match recommended vendor rules (match vendor/product and set group e.g., 'plugdev' or 'u2f', set mode 0660), reload rules, and replug. Changes must be deployed via config management with proper testing and security review.
Possible causes
Centralized udev rule change inadvertently set hidraw device ownership to root:root 0600.
95%Missing or conflicting vendor-supplied udev rule files in /etc/udev/rules.d/ causing precedence override.
60%User not in the group assigned to FIDO2 devices (e.g., plugdev) so even correct group/perm would block access.
10%AppArmor or SELinux policy restricting browser's access to /dev/hidraw devices (less likely given chown test success).
5%Suggested fixes
2
Diagnostic step 2
Create or restore vendor-recommended udev rule (match idVendor, idProduct) that sets GROUP="plugdev" (or 'u2f') and MODE="0660", place in /etc/udev/rules.d/70-u2f.rules, then run sudo udevadm control --reload-rules && sudo udevadm trigger --action=change to apply to existing devices.
3
Diagnostic step 3
Ensure affected users are members of the group granted device access (usermod -aG plugdev $USER) and have an active session (re-login required).
4
Diagnostic step 4
Validate by replugging token and testing with browser WebAuthn page and ykman without escalating to root. If AppArmor/SELinux constraints suspected, check audit logs (ausearch/audit.log) and test by temporarily relaxing profile in a controlled environment before rolling changes.
5
Diagnostic step 5
Roll changes through configuration management with a staged rollout and a rollback plan. If fleet-wide policy prevents granting group access, consider using a udev rule assigning a specific group for the security-team or use USB token middleware that runs as a privileged service and forwards requests securely.