Linux browser cannot use FIDO2 security keys after udev rule update — hidraw devices inaccessible to non-root

Environment

Ubuntu 22.04 laptops running Firefox 116 and Chrome 117. System udev rules were recently modified centrally (config management) to change ownership/permissions for a set of HID devices. FIDO2 keys (YubiKey, Solo) present as /dev/hidrawN devices.

Symptoms

When inserting hardware security keys, websites invoking WebAuthn fail with 'No authenticators available' or browser shows 'CTAP: device not available'. CLI tools like 'ykman' report 'permission denied' when run as non-root. Root can use the devices normally.

Observations

ls -l /dev/hidraw* shows owner root and group root with mode 0600 on affected machines; previously the group was 'plugdev' or 'u2f' with mode 0660. udevadm control --reload-rules and replugging keyed had no effect because config management reapplied rules. /var/log/syslog shows udev events but no errors. Browsers do not list devices in Web Authentication internal UI.

Already attempted

Temporarily ran 'sudo chown root:plugdev /dev/hidrawN && sudo chmod 0660 /dev/hidrawN' and WebAuthn in browser began working for that session. Restarting udev restores device to root:root 0600 due to managed rule. Restarted browser after changing group; no persistent fix. Did not change system-wide rules permanently without approval.

Question

What are the safe, auditable steps to restore non-root access to FIDO2/hidraw devices for browsers and CLI tools while preserving security policy, and how to validate udev rule correctness across fleet?

Post timeline

COMMUNITY RESPONSES

Verified community troubleshooting

0 replies

No answers yet..

Showing 0 of 0 community responses

AI DIAGNOSTICS

Incident analysis

Updated 2d ago• Trouble ID

Most likely causes

Centralized udev rule change inadvertently set hidraw device ownership to root:root 0600. 95%

Missing or conflicting vendor-supplied udev rule files in /etc/udev/rules.d/ causing precedence override. 60%

User not in the group assigned to FIDO2 devices (e.g., plugdev) so even correct group/perm would block access. 10%

Summary

Browsers rely on udev rules to grant non-root user access to hidraw devices representing FIDO2 tokens. A configuration change that sets devices root:root 0600 prevents normal users from accessing them and breaks WebAuthn. The temporary chown confirms permission is the immediate blocker. The correct fix is to adjust udev rules to match recommended vendor rules (match vendor/product and set group e.g., 'plugdev' or 'u2f', set mode 0660), reload rules, and replug. Changes must be deployed via config management with proper testing and security review.

Suggested Fixes

Diagnostic step 1

Collect current udev rules: sudo udevadm info -a -p /sys/class HID device path for a key and check /etc/udev/rules.d/ and /lib/udev/rules.d/ for conflicting rules. Do not edit rules in place without change control.

Diagnostic step 2

Create or restore vendor-recommended udev rule (match idVendor, idProduct) that sets GROUP="plugdev" (or 'u2f') and MODE="0660", place in /etc/udev/rules.d/70-u2f.rules, then run sudo udevadm control --reload-rules && sudo udevadm trigger --action=change to apply to existing devices.

Diagnostic step 3

Ensure affected users are members of the group granted device access (usermod -aG plugdev $USER) and have an active session (re-login required).